{"openapi":"3.1.0","info":{"title":"Trivon","version":"0.2.0"},"paths":{"/admin/signup":{"post":{"summary":"Admin Signup","operationId":"admin_signup_admin_signup_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignupRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Admin Signup Admin Signup Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/spend-cap":{"get":{"summary":"Get Spend Cap","description":"This tenant's model-spend cap snapshot — the effective cap (tighter of the\nplatform floor and any per-tenant config), the rolling-24h spend so far, the\nremaining budget, and whether the next model call is currently refused. Admin +\nRLS-scoped (tenant from the session). Meter errors surface as spent=null,\nrefused=true (fail-closed for spend).","operationId":"get_spend_cap_admin_api_spend_cap_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Spend Cap Admin Api Spend Cap Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Set Spend Cap","description":"Set this tenant's per-day token cap (config, never hardwired). Admin +\nRLS-scoped — the WITH CHECK pins the row to the admin's own tenant. A cap of 0\ndeliberately pauses the tenant's model spend; a negative cap is refused. The\nplatform floor still bounds it from above (the effective cap is the tighter).","operationId":"set_spend_cap_admin_api_spend_cap_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SpendCapRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Set Spend Cap Admin Api Spend Cap Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/api-keys":{"get":{"summary":"Get Api Keys","operationId":"get_api_keys_admin_api_api_keys_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Api Keys Admin Api Api Keys Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Post Api Key","operationId":"post_api_key_admin_api_api_keys_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyCreateRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Api Key Admin Api Api Keys Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/api-keys/{principal_id}/rotate":{"post":{"summary":"Post Api Key Rotate","operationId":"post_api_key_rotate_admin_api_api_keys__principal_id__rotate_post","parameters":[{"name":"principal_id","in":"path","required":true,"schema":{"type":"string","title":"Principal Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyRotateRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Api Key Rotate Admin Api Api Keys  Principal Id  Rotate Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/api-keys/{principal_id}/revoke":{"post":{"summary":"Post Api Key Revoke","operationId":"post_api_key_revoke_admin_api_api_keys__principal_id__revoke_post","parameters":[{"name":"principal_id","in":"path","required":true,"schema":{"type":"string","title":"Principal Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyRevokeRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Api Key Revoke Admin Api Api Keys  Principal Id  Revoke Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/mtls-certs":{"get":{"summary":"Get Mtls Certs","operationId":"get_mtls_certs_admin_api_mtls_certs_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Mtls Certs Admin Api Mtls Certs Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Post Mtls Cert","operationId":"post_mtls_cert_admin_api_mtls_certs_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsCertCreateRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Mtls Cert Admin Api Mtls Certs Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/mtls-certs/{fingerprint}/revoke":{"post":{"summary":"Post Mtls Cert Revoke","operationId":"post_mtls_cert_revoke_admin_api_mtls_certs__fingerprint__revoke_post","parameters":[{"name":"fingerprint","in":"path","required":true,"schema":{"type":"string","title":"Fingerprint"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsCertRevokeRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Mtls Cert Revoke Admin Api Mtls Certs  Fingerprint  Revoke Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/evidence-packs/assemble":{"post":{"summary":"Post Evidence Pack Assemble","description":"Assemble and WORM-seal one tenant-scoped evidence pack.\n\nAdmin + membership-assurance gated, then the assembler reads only under the\ncaller's own RLS tenant context. A foreign audit_ref/record_id therefore\nresolves to the same not-found refusal as a nonexistent one.","operationId":"post_evidence_pack_assemble_admin_api_evidence_packs_assemble_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EvidencePackAssembleRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Evidence Pack Assemble Admin Api Evidence Packs Assemble Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/starter-pack":{"get":{"summary":"Get Starter Pack","description":"The illustrative starter pack the onboarding button applies. READ-ONLY.\n\nServes ``trivon/starter_pack.py`` verbatim — the SAME module\n``scripts/demo_tenant_setup.py`` provisions the public demo tenant from, so a new\ncustomer's workspace and the public demo are seeded from one definition rather than\ntwo that drifted (tests/test_ui05_starter_pack.py A7 compares them field for field).\n\nThe payload carries the pack in the ORDER it has to be applied — roles, then\ndocuments, then authorities — because ``admin.add_authority`` refuses an authority\nnaming a role the tenant has not declared, and a decision's citation is only\nanswerable once its document is live. The order is part of the contract, not a rule\nthe browser reinvents.\n\nAdmin-gated like every other /admin/api read. The content is not secret (it is\nexample policy text this repo ships in the clear), but an anonymous surface serving\nit would be a new public door for no gain — /demo and /public/ask already show the\nsame seven decisions, as governed answers rather than as raw configuration.","operationId":"get_starter_pack_admin_api_starter_pack_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Starter Pack Admin Api Starter Pack Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/onboarding":{"get":{"summary":"Get Onboarding","description":"This admin's \"start here\" state: the one required step, and what is already loaded.\n\nTWO facts the dashboard cannot derive on its own:\n\n``email_verified`` / ``model_answers_gated`` — the ONE required step. Verification\ngates the model-SPEND channel and nothing else: an unverified admin can declare\nroles, decisions and documents all day (the whole wizard works), and Gates B and C\nstill escalate and route at zero tokens; only a model-COMPOSED answer is withheld.\nBoth fields are read through ``box_b/verification``'s own functions —\n``model_answers_gated`` is ``verification.model_call_refused``, the very predicate\n``engine.ask`` consults, not a second copy of its rules — so the page can never tell\na user they are gated when they are not, or the reverse. ``email_verified`` is None\nfor a caller that is not an email account at all.\n\n``starter_pack`` — whether this tenant already holds the pack, so the button can say\n\"already loaded\" instead of re-running and so a HALF-applied pack (a run interrupted\nbetween the documents and the authorities) is visible as 'partial' rather than\nreading as untouched. Computed by comparing the pack's own decision keys and citation\ntokens against this tenant's rows, under the admin's own RLS context.","operationId":"get_onboarding_admin_api_onboarding_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Onboarding Admin Api Onboarding Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/roles":{"get":{"summary":"Get Roles","operationId":"get_roles_admin_api_roles_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Roles Admin Api Roles Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Post Role","operationId":"post_role_admin_api_roles_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Role Admin Api Roles Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/authority":{"get":{"summary":"Get Authority","operationId":"get_authority_admin_api_authority_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Authority Admin Api Authority Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Post Authority","operationId":"post_authority_admin_api_authority_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorityRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Authority Admin Api Authority Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/members/{target_user_id}/sessions/terminate":{"post":{"summary":"Post Admin Terminate Member Sessions","operationId":"post_admin_terminate_member_sessions_admin_api_members__target_user_id__sessions_terminate_post","parameters":[{"name":"target_user_id","in":"path","required":true,"schema":{"type":"string","title":"Target User Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminTerminateSessionsRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Admin Terminate Member Sessions Admin Api Members  Target User Id  Sessions Terminate Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/members":{"post":{"summary":"Post Add Membership","description":"TRI-ORG-4: add an EXISTING principal (an existing `users` row) to this tenant.","operationId":"post_add_membership_admin_api_members_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddMembershipRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Add Membership Admin Api Members Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/members/{target_user_id}/role":{"post":{"summary":"Post Change Membership Role","description":"TRI-ORG-4: change an existing member's role (bumps membership_epoch).","operationId":"post_change_membership_role_admin_api_members__target_user_id__role_post","parameters":[{"name":"target_user_id","in":"path","required":true,"schema":{"type":"string","title":"Target User Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChangeMembershipRoleRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Change Membership Role Admin Api Members  Target User Id  Role Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/members/{target_user_id}/end":{"post":{"summary":"Post End Membership","description":"TRI-ORG-4: end a membership (DELETEs the row — never valid_to).","operationId":"post_end_membership_admin_api_members__target_user_id__end_post","parameters":[{"name":"target_user_id","in":"path","required":true,"schema":{"type":"string","title":"Target User Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post End Membership Admin Api Members  Target User Id  End Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/invites":{"post":{"summary":"Post Issue Invite","description":"TRI-ORG-5: issue a pending invite. `claim_mode='email'` sends it through the\nprovider path; `claim_mode='out_of_band'` mints the link without sending anything\n(OD-ORG-6's additive second entrypoint) and returns it in `link` for the admin to\ndistribute manually.","operationId":"post_issue_invite_admin_api_invites_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssueInviteRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Issue Invite Admin Api Invites Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/org-switch":{"post":{"summary":"Post Org Switch","description":"TRI-ORG-6: switch the caller's active org WITHOUT re-entering credentials — mints\na fresh session token for `target_tenant_id`, refused (403) unless the caller already\nholds a membership there (OD-ORG-5: intra-principal only). Any authenticated member\nmay call this, not only admins.","operationId":"post_org_switch_admin_api_org_switch_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgSwitchRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Org Switch Admin Api Org Switch Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/resolve":{"get":{"summary":"Get Resolve","operationId":"get_resolve_admin_api_resolve_get","parameters":[{"name":"decision","in":"query","required":false,"schema":{"type":"string","default":"","title":"Decision"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Resolve Admin Api Resolve Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/risk-posture/floors":{"get":{"summary":"Get Risk Posture Floors","operationId":"get_risk_posture_floors_admin_api_risk_posture_floors_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Risk Posture Floors Admin Api Risk Posture Floors Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Post Risk Posture Floor","operationId":"post_risk_posture_floor_admin_api_risk_posture_floors_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RiskPostureFloorRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Risk Posture Floor Admin Api Risk Posture Floors Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/risk-posture/assign-worker":{"post":{"summary":"Post Risk Posture Assign Worker","operationId":"post_risk_posture_assign_worker_admin_api_risk_posture_assign_worker_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RiskPostureAssignmentRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Risk Posture Assign Worker Admin Api Risk Posture Assign Worker Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/kb":{"get":{"summary":"Get Kb","operationId":"get_kb_admin_api_kb_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Kb Admin Api Kb Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Post Kb","operationId":"post_kb_admin_api_kb_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KbRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Kb Admin Api Kb Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/kb/upload":{"post":{"summary":"Post Kb Upload","description":"Load a real PDF/Word file: extract its text server-side, then run the EXISTING\ningest. Lands in PROBATION exactly like a pasted document (SBX-001).\n\nTHIS IS NOT A SECOND WRITE PATH. The only thing this route does that\n`POST /admin/api/kb` does not is turn bytes into the `content` string; from\n`admin.add_kb` onward the two are the same call, so there is no validation this\ndoor can skip and no way for an uploaded document to enter live. Rebuilding\ningest here — even \"just the insert\" — would be a bypass, and it is the reason\nthe extracted text is passed to `add_kb` rather than to `db.insert_kb_document`.\n\nORDER IS DELIBERATE: extract FIRST, then write. A refusal from the extractor\nmust not leave a half-made row behind, and there is nothing to roll back if\nnothing was written. The extractor never returns empty text (it raises), so\n`add_kb` cannot be handed a silently-blank document.\n\nRoute path note: `/admin/api/kb/upload` cannot be shadowed by the neighbouring\n`/admin/api/kb/{doc_id}/promote` — that pattern needs a THIRD segment, so no\ndoc_id can ever match this path however the two are ordered.","operationId":"post_kb_upload_admin_api_kb_upload_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KbUploadRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Kb Upload Admin Api Kb Upload Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/kb/{doc_id}/promote":{"post":{"summary":"Promote Kb","description":"Promote a staged KB doc probation→live (the season-before-serve human gate).\nOnly after this does the doc become servable by retrieval.","operationId":"promote_kb_admin_api_kb__doc_id__promote_post","parameters":[{"name":"doc_id","in":"path","required":true,"schema":{"type":"string","title":"Doc Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KbDispositionRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Promote Kb Admin Api Kb  Doc Id  Promote Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/kb/{doc_id}/reject":{"post":{"summary":"Reject Kb","description":"Reject a staged KB doc → rejected (never served), recording who/when/why.","operationId":"reject_kb_admin_api_kb__doc_id__reject_post","parameters":[{"name":"doc_id","in":"path","required":true,"schema":{"type":"string","title":"Doc Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KbDispositionRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Reject Kb Admin Api Kb  Doc Id  Reject Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/intake":{"post":{"summary":"Post Intake","description":"Run the INTAKE rule-extraction funnel (Stage 0, the keystone) — admin-session-gated and\ntenant-scoped exactly like /admin/api/cem. The funnel turns the fuzzy goal into a checkable\nsuccess rule and lets the §2 validity gate be the sole arbiter of EARNED vs ATTESTED, or\nclassifies a World-1 (audit-touching) agent NEVER-AUTONOMOUS at intake. It EMITS through the\nauthor path (reused, not rebuilt), so the returned CEM lands under the admin's own RLS context.\nReturns the classification + the descent (observable / set-aside signals + proxy contract) +\nthe §2 gate result + (for earned) the authored, drivable CEM.","operationId":"post_intake_admin_api_intake_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/trivon__admin_api__IntakeRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Intake Admin Api Intake Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/cem":{"post":{"summary":"Post Cem","description":"Author a CEM. conform() validates the spec (reused); the tier fork decides the rest.\nA conform failure or a §2-gate refusal returns the stored INVALID record (with its\nreasons) — it does NOT crash and it is NOT registered/drivable. A valid earned rule, or\nan attested / never_autonomous tier, registers the CEM (drivable by identity via the\ncontrol plane's GET /portal/api/control/ladder?cem=<cem_identity>).","operationId":"post_cem_admin_api_cem_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CemAuthorRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Cem Admin Api Cem Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/cems":{"get":{"summary":"Get Cems","description":"The tenant's CEM roster: each entry's tier, lifecycle status, world class, canonical\nidentity, and durable rung (shadow until graduated). Read-only.","operationId":"get_cems_admin_api_cems_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Cems Admin Api Cems Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/cem/{cem_id}":{"get":{"summary":"Get Cem","description":"One authored CEM: its status, tier, rule pointer + validity, and durable rung.","operationId":"get_cem_admin_api_cem__cem_id__get","parameters":[{"name":"cem_id","in":"path","required":true,"schema":{"type":"string","title":"Cem Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Cem Admin Api Cem  Cem Id  Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"put":{"summary":"Put Cem","description":"Re-author a CEM: re-conform + re-gate. A rule EDIT mints a new immutable rule version\n(the old version + any scores against it are untouched); an unchanged rule keeps its\nversion. A conform failure marks the record invalid without a crash.","operationId":"put_cem_admin_api_cem__cem_id__put","parameters":[{"name":"cem_id","in":"path","required":true,"schema":{"type":"string","title":"Cem Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CemAuthorRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Put Cem Admin Api Cem  Cem Id  Put"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/cem/{cem_id}/score":{"post":{"summary":"Post Cem Score","description":"Append ONE scored case to the CEM's rule version's DURABLE accuracy series — the\npersistent series that replaces the volatile per-process accuracy cache. Only an earned\nCEM (one with a rule) can be scored; the outcome must be a valid confusion cell.","operationId":"post_cem_score_admin_api_cem__cem_id__score_post","parameters":[{"name":"cem_id","in":"path","required":true,"schema":{"type":"string","title":"Cem Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScoreRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Cem Score Admin Api Cem  Cem Id  Score Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/assignment-runs":{"post":{"summary":"Post Assignment Run","description":"ENG-019: compute, persist, and surface one assignment acceptance-axis score.","operationId":"post_assignment_run_admin_api_assignment_runs_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssignmentRunRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Assignment Run Admin Api Assignment Runs Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"get":{"summary":"Get Assignment Runs","description":"ENG-019: list persisted assignment acceptance-axis scores for the admin's tenant.","operationId":"get_assignment_runs_admin_api_assignment_runs_get","parameters":[{"name":"cem_identity","in":"query","required":false,"schema":{"type":"string","default":"","title":"Cem Identity"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50,"title":"Limit"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Assignment Runs Admin Api Assignment Runs Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/fleet-telemetry/default-contract":{"get":{"summary":"Get Fleet Telemetry Default Contract","description":"AGT-018: read the tenant's fleet-failure telemetry/default contract.\nAbsence is the default participating contract; an explicit refusal costs FULL_AUTO\nprotection but never writes success evidence.","operationId":"get_fleet_telemetry_default_contract_admin_api_fleet_telemetry_default_contract_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Fleet Telemetry Default Contract Admin Api Fleet Telemetry Default Contract Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Post Fleet Telemetry Default Contract","description":"AGT-018: append a telemetry participation decision. Newest row wins; no row is\nrewritten, so refusal/participation transitions remain auditable.","operationId":"post_fleet_telemetry_default_contract_admin_api_fleet_telemetry_default_contract_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FleetTelemetryContractRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Fleet Telemetry Default Contract Admin Api Fleet Telemetry Default Contract Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/fleet-telemetry/failure-events":{"post":{"summary":"Post Fleet Failure Telemetry Event","description":"AGT-018: aggregate a fleet failure event as a lineage demotion signal only.\nThis route never records a promotion or success score.","operationId":"post_fleet_failure_telemetry_event_admin_api_fleet_telemetry_failure_events_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FleetFailureTelemetryRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Fleet Failure Telemetry Event Admin Api Fleet Telemetry Failure Events Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/cem/{cem_id}/harden":{"post":{"summary":"Post Cem Harden","description":"AGT-003 landing (b) — harden a ratified SOP candidate into a CEM RULE EDIT: mint a new\nimmutable rule_version and repoint the CEM. The agent's live capability is withheld\n(capability_rule_version_stale) until it re-earns under the new definition (envelope law). This\nknocks a LIVE worker offline until re-earned — a law-correct product consequence (OD-10).","operationId":"post_cem_harden_admin_api_cem__cem_id__harden_post","parameters":[{"name":"cem_id","in":"path","required":true,"schema":{"type":"string","title":"Cem Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HardenRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Cem Harden Admin Api Cem  Cem Id  Harden Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/cem/{cem_id}/supersede":{"post":{"summary":"Post Cem Supersede","description":"AGT-005 — author a SUPERSEDING successor (v_{n+1}) of an existing CEM. The successor is\nauthored + §2-gated like any CEM, then linked into the predecessor's lineage. It gets its OWN\nidentity + rung (default SHADOW) and re-earns from scratch; the predecessor keeps its rung and\nlive authority until an explicit cutover (POST /portal/api/control/lineage/cutover).","operationId":"post_cem_supersede_admin_api_cem__cem_id__supersede_post","parameters":[{"name":"cem_id","in":"path","required":true,"schema":{"type":"string","title":"Cem Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CemAuthorRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Cem Supersede Admin Api Cem  Cem Id  Supersede Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/cem/{cem_id}/accuracy_series":{"get":{"summary":"Get Cem Accuracy Series","description":"AGT-012 — the per-week accuracy-over-time series for an earned CEM (accuracy + fp/fn split\nper week; a silent week renders as an explicit gap, never interpolated). A pure rendering over\nthe durable rule_scores — no new write path. Only an earned CEM (with a rule) has a series.","operationId":"get_cem_accuracy_series_admin_api_cem__cem_id__accuracy_series_get","parameters":[{"name":"cem_id","in":"path","required":true,"schema":{"type":"string","title":"Cem Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Get Cem Accuracy Series Admin Api Cem  Cem Id  Accuracy Series Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/activity":{"get":{"summary":"Tower Activity","description":"Recent governed activity + outcome rollup for the SESSION's tenant only.\n\nREAD-ONLY: both calls are SELECT-only over audit_log under RLS. The tenant is\ntaken from the validated session — never client input — so an operator sees\nonly their own tenant's activity.","operationId":"tower_activity_portal_api_activity_get","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50,"title":"Limit"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Tower Activity Portal Api Activity Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/sandbox":{"post":{"summary":"Sandbox Run","description":"Run a test question through the REAL governed /ask path and trace it.\n\nThe OUTCOME/citation/answer come from engine.ask — the exact governed engine\n/ask uses (Gate B/C pre-model, model only on proceed, Gate D seal, audit).\nThe retrieved-sources list and the gate/authority decision are the SAME\nread-only pre-model functions engine.ask runs internally (retrieval.retrieve,\npolicy.decide), surfaced for visibility. No special sandbox model path; the\nadmin watches how the engine WILL answer on their content before go-live.\n\nSOURCE-IP FLOOD (INV-020): this path deliberately carries NO app-level\nsource-IP FailClosedMiddleware mount (unlike answer/reading/action/`/ask`,\nwhich are unauthenticated-reachable). It is ADMIN-SESSION-GATED — `_admin_or_401`\nbelow calls `admin.require_admin`, so an unauthenticated caller gets 401 and a\nnon-admin gets 403 BEFORE `engine.ask` is reached; it is not a pre-auth flood\nsurface. Edge source-IP flooding on ALL paths (this one included) is covered by\nthe PRIMARY layer — the AWS WAF Web ACL rate-based rules on the ALB (master-spec\nS6), which see the true client IP natively at the edge. So no app mount is owed\nhere; WAF provisioning is owed to TRIVON-AWS-IAC.","operationId":"sandbox_run_admin_api_sandbox_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SandboxRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Sandbox Run Admin Api Sandbox Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/capture/approve":{"post":{"summary":"Approve Candidate","description":"APPROVE a proposed rule: PROPOSED -> ACTIVE (it enters the SSOT and takes effect).\nAuthority-gated (admin), provenance-required, routed through the proven durable gate,\nfail-closed.","operationId":"approve_candidate_portal_api_capture_approve_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/trivon__capture_approve__DispositionRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Approve Candidate Portal Api Capture Approve Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/capture/reject":{"post":{"summary":"Reject Candidate","description":"REJECT a proposed rule: PROPOSED -> REJECTED (never enforced). Same gates as approve;\nit activates nothing.","operationId":"reject_candidate_portal_api_capture_reject_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/trivon__capture_approve__DispositionRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Reject Candidate Portal Api Capture Reject Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/whoami":{"get":{"summary":"Whoami","operationId":"whoami_portal_api_control_whoami_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Whoami Portal Api Control Whoami Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/ladder":{"get":{"summary":"Ladder State","description":"The rung + 7-factor vector for an agent. `?cem=<identity>` selects the agent; omitted ->\nthe demo evidence-flag CEM (unchanged). An unknown identity -> 404.","operationId":"ladder_state_portal_api_control_ladder_get","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Ladder State Portal Api Control Ladder Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/ladder/observe":{"post":{"summary":"Ladder Observe","description":"Feed ONE observation window to an agent, then run ONE real ladder cycle. Every decision is\nthe CEM's ACTUAL proposal from a REAL shadow run (autonomy.observe_via_shadow -> shadow_perform),\nNOT a hardcoded per-scenario flag (F1): the ladder scores what the CEM WOULD do against the rule.\nA 'clean' window runs the agent's OWN correct proposals (TP/TN); a 'degraded' window runs a\nKNOWN-BAD twin of the SAME agent whose real proposals MISS real violations (false-negatives that\ntank accuracy and trip demotion). `?cem=<identity>` selects the agent; omitted -> the demo CEM. A\nnon-record-scored agent (e.g. the device actuator) -> 409: its scoring harness is a later step\n(this surface builds a shadow.Record — the evidence-flag shape — so it never fakes a climb for an\nagent it cannot honestly score). The CycleResult is the REAL Box-B receipt.","operationId":"ladder_observe_portal_api_control_ladder_observe_post","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ObserveRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Ladder Observe Portal Api Control Ladder Observe Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/ladder/reset":{"post":{"summary":"Ladder Reset","description":"Reset an agent's EARNED rung to SHADOW. `?cem=<identity>` selects the agent; omitted -> the\ndemo CEM. The reset is audited (an operator lowering autonomy leaves a durable record) then the\ncached controller is started fresh (signal cleared). The rung is keyed by the agent's IDENTITY.","operationId":"ladder_reset_portal_api_control_ladder_reset_post","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Ladder Reset Portal Api Control Ladder Reset Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/lineage":{"get":{"summary":"Lineage View","description":"The lineage (career) for an agent: every member with its OWN rung (keyed by identity),\nderived superseded_by, and hr_state. `?cem=<identity>` selects any member of the chain.","operationId":"lineage_view_portal_api_control_lineage_get","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Lineage View Portal Api Control Lineage Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/lineage/cutover":{"post":{"summary":"Lineage Cutover","description":"ATOMIC handover cutover: `?cem=<predecessor identity>` + body successor identity. Revokes the\npredecessor's live capability, then declares the swap (predecessor superseded, successor the\nactive head). After this the predecessor can no longer act live — never both-live.","operationId":"lineage_cutover_portal_api_control_lineage_cutover_post","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CutoverRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Lineage Cutover Portal Api Control Lineage Cutover Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/lifecycle/backup-route":{"post":{"summary":"Lifecycle Backup Route","description":"Configure AGT-004 manager backup coverage for resolver step 9.","operationId":"lifecycle_backup_route_portal_api_control_lifecycle_backup_route_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BackupRouteRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Lifecycle Backup Route Portal Api Control Lifecycle Backup Route Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/lifecycle/backup-route/{grant_id}":{"delete":{"summary":"Lifecycle Revoke Backup Route","description":"Stamp a manager backup route closed; the audit-visible grant row remains.","operationId":"lifecycle_revoke_backup_route_portal_api_control_lifecycle_backup_route__grant_id__delete","parameters":[{"name":"grant_id","in":"path","required":true,"schema":{"type":"string","title":"Grant Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Lifecycle Revoke Backup Route Portal Api Control Lifecycle Backup Route  Grant Id  Delete"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/lifecycle/suspend":{"post":{"summary":"Lifecycle Suspend","description":"SUSPEND an agent: capability off (inert) + rung FROZEN + delivery halted. `?cem=<identity>`.","operationId":"lifecycle_suspend_portal_api_control_lifecycle_suspend_post","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuspendRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Lifecycle Suspend Portal Api Control Lifecycle Suspend Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/lifecycle/resume":{"post":{"summary":"Lifecycle Resume","description":"RESUME a suspended agent: the prior rung + delivery are restored (suspend never touched the\nrung). Refuses to resume an OFFBOARDED agent (that terminal state is AGT-006b's, not a suspend).","operationId":"lifecycle_resume_portal_api_control_lifecycle_resume_post","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Lifecycle Resume Portal Api Control Lifecycle Resume Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/lifecycle/offboard":{"post":{"summary":"Lifecycle Offboard","description":"AGT-006b (CORE) — TERMINAL retire: revoke the credential (disable the live capability), close\nthe rung (reset to shadow, audited), record the terminal 'offboarded' state (kept forever, never\na deletion). `?cem=<identity>`. The pending-item re-route is owed to TRI-WRK (not built) and is\nSURFACED in the response `pending_reroute`, never silently dropped. A re-authored twin is a NEW\nlineage/identity — this record persists for the offboarded one.","operationId":"lifecycle_offboard_portal_api_control_lifecycle_offboard_post","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OffboardRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Lifecycle Offboard Portal Api Control Lifecycle Offboard Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/action-ledger/{ledger_id}/feedback":{"post":{"summary":"Action Ledger Feedback","description":"Record one admin feedback row against an action-ledger record.\n\nAGT-014 keeps the concurrency and self-feedback rules in Box B: the ledger\nrejects the actor reviewing their own action, locks the action row, and relies\non the one-feedback-per-ledger unique fence for concurrent reviewers.","operationId":"action_ledger_feedback_portal_api_control_action_ledger__ledger_id__feedback_post","parameters":[{"name":"ledger_id","in":"path","required":true,"schema":{"type":"string","title":"Ledger Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LedgerFeedbackRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Action Ledger Feedback Portal Api Control Action Ledger  Ledger Id  Feedback Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/proposal/disposition":{"post":{"summary":"Proposal Disposition","description":"Record a human's APPROVE/REJECT of a specific shadow-action proposal, per-agent, durably —\nthen feed it into that agent's earned-autonomy OVERRIDE signal. `?cem=<identity>` selects the\nagent (omitted -> the demo evidence-flag CEM); a non-record-scored agent -> 409 (the SAME honest\nboundary observe/probe carry — this surface builds a shadow.Record and will not fake a signal\nfor an agent it cannot score).\n\nTHE SEMANTICS (SUCCESS_RULE_CONTRACT_v1 — the load-bearing part):\n  * a REJECT is an OVERRIDE (overridden=True) — it feeds human_override_rate (factor 7) + the\n    override_spike demotion trigger; an APPROVE is concurrence (overridden=False);\n  * NEITHER moves the rule-accuracy signal — observe_via_shadow scores the CEM's REAL proposal\n    against the rule INDEPENDENT of the human's vote, so the accuracy outcome is a pure function\n    of the PROPOSAL (invariant to approve/reject). The human is a veto + override signal, never\n    the accuracy trainer.\n\nORDERING (the INV-009 discipline): the disposition is durably RECORDED FIRST (fail-closed 503 on\ndurability loss) and only THEN fed into the (volatile) override signal — so there is never a\nsignal change without a durable, auditable record of the human vote behind it.","operationId":"proposal_disposition_portal_api_control_proposal_disposition_post","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/trivon__control_api__DispositionRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Proposal Disposition Portal Api Control Proposal Disposition Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/agents":{"get":{"summary":"Agents List","description":"List the agents (CEMs) the control plane can DRIVE — the roster a UI renders to let an operator\nSELECT one to steer. Each entry is keyed by canonical IDENTITY (the durable-rung key, #41) — the\nvalue the other endpoints take as `?cem=<identity>` — and carries:\n  * its current durable RUNG, read from the SAME autonomy_rung row the live acting path gates\n    (reconciled from the store, never a cache), so the roster shows real earned autonomy;\n  * its WORLD class (World-2 = autonomy-eligible; World-1 = human-forever, rung pinned at shadow);\n  * WHICH control surfaces are wired for it (`record_scored` -> observe/probe are available; a\n    non-record-scored agent exposes only the universal state/reset surfaces). The UI uses this to\n    avoid offering a dead observe/probe button for an agent whose scoring harness is a later step.\nRead-only: listing never creates a controller or touches a rung. Ordered demo-first (registry\norder) for a stable roster.","operationId":"agents_list_portal_api_control_agents_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Agents List Portal Api Control Agents Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/agent-instances":{"get":{"summary":"Agent Instances List","description":"List runtime instances for the tenant. `?cem=<identity>` filters to one CEM\ndefinition. Trust is not read from the instance row; the shared rung remains the\nCEM identity's autonomy_rung/proof envelope.","operationId":"agent_instances_list_portal_api_control_agent_instances_get","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"include_retired","in":"query","required":false,"schema":{"type":"boolean","default":true,"title":"Include Retired"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Agent Instances List Portal Api Control Agent Instances Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Agent Instances Spawn","description":"Spawn one disposable runtime instance for a drivable CEM identity.","operationId":"agent_instances_spawn_portal_api_control_agent_instances_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentInstanceSpawnRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Agent Instances Spawn Portal Api Control Agent Instances Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/agent-instances/{instance_id}/retire":{"post":{"summary":"Agent Instances Retire","description":"Retire one runtime instance and requeue the work it claimed.","operationId":"agent_instances_retire_portal_api_control_agent_instances__instance_id__retire_post","parameters":[{"name":"instance_id","in":"path","required":true,"schema":{"type":"string","title":"Instance Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentInstanceRetireRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Agent Instances Retire Portal Api Control Agent Instances  Instance Id  Retire Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/kills":{"get":{"summary":"Kills State","description":"The kills VISIBLE to this tenant: its own TENANT/CEM/ROLE rows + the platform GLOBAL\nrow. RLS-scoped read (db.fetch_active_kill_switches returns own ∪ global) — a tenant can\nnever SEE another tenant's switch, exactly as it can never flip one.","operationId":"kills_state_portal_api_control_kills_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Kills State Portal Api Control Kills Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/kills/trip":{"post":{"summary":"Kills Trip","description":"ARM a kill. TENANT/CEM/ROLE write under the tenant's OWN RLS context (the WITH CHECK\npins the row to this tenant — it can never arm another's). GLOBAL is operator-only:\nit goes through the superuser path AND requires the platform-operator credential.\n\nA cem-scope target is RESOLVED against this tenant's drivable-CEM registry: an unknown CEM\nname is REFUSED with a clear 400 and NOTHING is written. A cem kill is matched on the CEM\n`cem_name`, so arming a name that no drivable agent carries would persist a brake that can\nnever fire — a silent no-op that lies to the operator ('I stopped it') while stopping\nnothing. Refuse-at-arm makes 'the kill is set' mean 'the kill can halt this agent'.","operationId":"kills_trip_portal_api_control_kills_trip_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KillRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Kills Trip Portal Api Control Kills Trip Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/kills/clear":{"post":{"summary":"Kills Clear","description":"DISARM a kill — the inverse of trip, the same authority split. TENANT/CEM/ROLE clear\nunder the tenant's own RLS context; GLOBAL needs the operator credential. Clearing is\nUNCONDITIONAL: unlike trip, a cem target is NOT resolved against the registry — a brake must\nALWAYS be releasable, including a stale kill whose CEM was since removed or renamed (refusing\nto clear it would strand an un-releasable halt). Clearing an absent kill is a harmless no-op.","operationId":"kills_clear_portal_api_control_kills_clear_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KillRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Kills Clear Portal Api Control Kills Clear Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/recovery/assisted/approve":{"post":{"summary":"Assisted Recovery Approve","description":"Approve a layer-3 account recovery request.\n\nThis is platform-operator assisted recovery, not tenant self-service: the caller must be\nan authenticated admin, must have a fresh step-up stamp, and must present the operator\ntoken. The database approval itself runs through the operator role; the raw recovery\ntoken is emailed to the verified account and is never returned to the operator.","operationId":"assisted_recovery_approve_portal_api_control_recovery_assisted_approve_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssistedRecoveryApproveRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Assisted Recovery Approve Portal Api Control Recovery Assisted Approve Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/live/enable":{"post":{"summary":"Live Enable","description":"GRANT the live-commit capability for the pinned evidence-flag CEM. Owner-gated + ALL\npreconditions fail-closed (first failure named); AUDIT-BEFORE-EFFECT. Cannot enable a shadow /\nWorld-1 / irreversible / out-of-scope CEM, cannot self-authorize (Box B + operator token),\ncannot widen scope (references DEFAULT_LIMITED_LIVE_SCOPE), cannot grant forever (bounded TTL).","operationId":"live_enable_portal_api_control_live_enable_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LiveEnableRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Live Enable Portal Api Control Live Enable Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/live/disable":{"post":{"summary":"Live Disable","description":"REVOKE the live-commit capability INSTANTLY (active=false, read every act + by the RESIDUAL-2\nprecommit re-check, so the very next act — even one in flight — falls back to shadow).\nAUDIT-BEFORE-EFFECT. Same owner gate as enable.","operationId":"live_disable_portal_api_control_live_disable_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LiveDisableRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Live Disable Portal Api Control Live Disable Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/live":{"get":{"summary":"Live State","description":"The tenant's ACTIVE live capabilities (RLS-scoped) — the console's live-authority window. A\ntenant sees ONLY its own grants (attack 7, closed at the data layer).","operationId":"live_state_portal_api_control_live_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Live State Portal Api Control Live Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/control/probe":{"post":{"summary":"Probe","description":"Run a record-scored agent through the FULL governed gate stack against the REAL DB kill\nstore, GATED BY ITS DURABLE RUNG. `?cem=<identity>` selects the agent; omitted -> the demo\nevidence-flag CEM (unchanged). A non-record-scored agent -> 409 (this surface builds a\nshadow.Record — the evidence-flag shape — so it only probes an agent it can honestly drive).\nThis is the operator's 'watch + see-it-halt' surface, wired to the earned-autonomy ladder's\nlive state:\n\n  * rung == SHADOW (the un-graduated default) -> the action PROCEEDS in shadow; the\n    response carries the SHADOW proposal (would_flag, the modeled mutation + post-state)\n    and its DERIVED mutated=False — nothing committed. The operator watches what the CEM\n    WOULD do, safely.\n  * rung >= THRESHOLD (earned via the ladder) -> the action ACTS FOR REAL within its\n    autonomy (mutated=True, the live world moves) through the ladder cage — the SAME\n    durable rung the live acting path enforces, not a detached demo.\n  * a kill armed (any rung) -> the action HALTS: outcome='killed' and the scope that\n    stopped it. The halt is enforced in Box B (ledger.execute -> killswitch.evaluate),\n    BEFORE any write-ahead — not a greyed button. mutated is False, the ledger untouched.\n\nBoth the rung store and the kill store are the REAL durable Postgres stores (the default\nacting path), so the rung the operator sees gates this action and a kill the operator\ntripped genuinely stops it.","operationId":"probe_portal_api_control_probe_post","parameters":[{"name":"cem","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cem"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProbeRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Probe Portal Api Control Probe Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/adviser/first-login-hire":{"post":{"summary":"Adviser First Login Hire","description":"TRI-AGT-002 first-login hire flow.\n\nMember-gated, no engine import, no parallel queue: it runs the shared intake\nfunnel and emits the deferred `agent_request` through work_queue.create.","operationId":"adviser_first_login_hire_portal_api_adviser_first_login_hire_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FirstLoginHireRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Adviser First Login Hire Portal Api Adviser First Login Hire Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/adviser/offering":{"get":{"summary":"Adviser Offering","description":"This tenant's Adviser-lane offering tier — READ FROM CONFIG, not hardcoded.\n\nThe tier comes from tenant_offering under RLS (the tenant is taken from the\nvalidated session, never client input). A tenant with no row is Standard by\nconstruction (the column default), surfaced as configured=false.\n\n``profile`` (TRI-SRF-015 renderer half, completes TRI-SRF-006 — this surface\nused to claim \"profile carrier\" with zero profile machinery behind it) is\nthe resolved SRF-015 interaction profile: an OPTIONAL ``?profile=`` query\nparam, run through the SAME fail-safe ``render_profiles.resolve_profile``\nask_render's renderer hooks use. Per-population DEFAULTS (OD-SRF-5:\nauditor->audit, ops->checklist, exec->context) need the\n``platform.adaptive_profiles`` assignment table, which is item 3b — BLOCKED\non a schema handoff this family may not make. So today this resolves an\nEXPLICIT caller choice against the safe default (``fast``); it infers\nnothing from the tenant, the session, or the offering row.","operationId":"adviser_offering_portal_api_adviser_offering_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Adviser Offering Portal Api Adviser Offering Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/adviser/offering":{"post":{"summary":"Set Adviser Offering","description":"Set the tenant's Adviser-lane tier (standard|custom). Admin + RLS-scoped.\n\nRides the existing self-serve admin shape: an admin session is required and\nthe write lands UNDER RLS scoped to the admin's own tenant, so an admin of\ntenant A can never set tenant B's offering. Custom is request-and-provision\non the operations side too; here the toggle records the chosen tier — the\nbespoke logic itself is loaded through the existing seasoning/Sandbox flow.","operationId":"set_adviser_offering_admin_api_adviser_offering_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OfferingRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Set Adviser Offering Admin Api Adviser Offering Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/adviser/intake":{"post":{"summary":"Adviser Intake","description":"Custom-tier doctrine intake (TRI-CUB-005, step 1). Admin + RLS-scoped:\nthe document lands under the ADMIN'S OWN tenant, staged in PROBATION\n(box_b/custom_intake.ingest -> db.insert_kb_document — never instantly\nlive). 400 not_custom_tier unless the tenant's offering is 'custom'\n(Standard tenants have no bespoke corpus to intake); 409\nreserved_source_shadow if `source` collides with a base-ink doctrine\ncitation (doctrine_kb.py, CUB-008) — a tenant corpus can never claim a\nplatform citation token.","operationId":"adviser_intake_admin_api_adviser_intake_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/trivon__adviser__IntakeRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Adviser Intake Admin Api Adviser Intake Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/adviser/horizon-check":{"post":{"summary":"Adviser Horizon Check","description":"TRI-CUB-011. Member-gated (the same level as the offering GET — reading\nan answer-shape classification is not a config write). Returns\n{shape, options} — options is [] unless shape == 'expanded_parallel_options'.\n422 on a malformed hit (HorizonError('uncited_option'/'no_options')) — the\nWHOLE classification refuses rather than silently rendering a shorter,\nfiltered option list.","operationId":"adviser_horizon_check_portal_api_adviser_horizon_check_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HorizonCheckRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Adviser Horizon Check Portal Api Adviser Horizon Check Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/adviser/standing-check":{"post":{"summary":"Adviser Standing Check","description":"TRI-CUB-012 (a)+(b). Member-gated, stateless, side-effect-free. Returns\n{listening_band, premise} — `premise.flagged` is True only when the question\nasserts a number a topically-overlapping hit contradicts (never a bare\ncoincidental digit elsewhere).","operationId":"adviser_standing_check_portal_api_adviser_standing_check_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StandingCheckRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Adviser Standing Check Portal Api Adviser Standing Check Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/adviser/ding-dong":{"post":{"summary":"Adviser Ding Dong","description":"TRI-CUB-012 (d). Member-gated. `accept=False` is a silent dismissal — no\nqueue write (nothing about a declined offshoot is worth a row). `accept=True`\nspawns a 'gap_request' work item, refused 409 ding_dong_cap_exceeded the\nmoment `session_bell_count` (the caller's own running count, pre-this-offer)\nreaches the cap — enforced BEFORE any DB round-trip.","operationId":"adviser_ding_dong_portal_api_adviser_ding_dong_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DingDongRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Adviser Ding Dong Portal Api Adviser Ding Dong Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/adviser/narrow-and-test":{"post":{"summary":"Adviser Narrow And Test","description":"TRI-CUB-012 (c). Admin-gated: diagnoses which consensus-ladder rung a set\nof candidate positions sits on. Only the ONE rung this module can safely\nautomate — narrow_and_test — spawns a real 'review' work item (the tie-break,\nrun not argued); authoritative_call is diagnosed but never auto-resolved (the\nadvice-chair rule's rung 4 is a human, owner-role pick, not this endpoint's\nto make). 400 insufficient_positions on fewer than two positions.","operationId":"adviser_narrow_and_test_admin_api_adviser_narrow_and_test_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NarrowAndTestRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Adviser Narrow And Test Admin Api Adviser Narrow And Test Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/compliance/verify-now":{"get":{"summary":"Compliance Verify Now","description":"Verify the tenant's audit integrity state under the CP-08 tier boundary.","operationId":"compliance_verify_now_portal_api_compliance_verify_now_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Compliance Verify Now Portal Api Compliance Verify Now Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/compliance/disclosure-pack/export":{"post":{"summary":"Compliance Disclosure Pack Export","description":"Build an AGT-017 SKU disclosure bundle from stored tenant evidence.","operationId":"compliance_disclosure_pack_export_portal_api_compliance_disclosure_pack_export_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisclosurePackExportRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Compliance Disclosure Pack Export Portal Api Compliance Disclosure Pack Export Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/compliance/authority-at-a-date":{"get":{"summary":"Compliance Authority At Date","description":"CMP-009 authority-grant report at one as-of timestamp.","operationId":"compliance_authority_at_date_portal_api_compliance_authority_at_a_date_get","parameters":[{"name":"as_of","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"As Of"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Compliance Authority At Date Portal Api Compliance Authority At A Date Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/demo/api/replay":{"get":{"summary":"Demo Replay","operationId":"demo_replay_demo_api_replay_get","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":100,"title":"Limit"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/demo/api/live":{"post":{"summary":"Demo Live","description":"Verified live demo lane: server-held demo tenant, never caller-selected.","operationId":"demo_live_demo_api_live_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DemoLiveRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/assure/socket1/ask":{"post":{"summary":"Socket1 Ask","operationId":"socket1_ask_assure_socket1_ask_post","parameters":[{"name":"x-trivon-principal","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Trivon-Principal"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/assure/socket1/lookup":{"post":{"summary":"Socket1 Lookup","description":"Governed LOOKUP for a machine consumer (Assure). Same gates/engine/audit as /ask, behind\nthe fail-closed service_principal auth; returns {answer, citations[], governance_outcome,\naudit_ref}. OUTAGE-REFLEX: any internal failure (DB/model/engine outage) resolves to a CLEAR\ngoverned refusal — never a hang, a stack trace, or a fabricated answer — so the caller's LOCAL\nREFLEX FLOOR can fire; a Trivon-side fault must never block Assure's safety-critical local path.","operationId":"socket1_lookup_assure_socket1_lookup_post","parameters":[{"name":"x-trivon-principal","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Trivon-Principal"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayLookupRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/iot/socket/reading":{"post":{"summary":"Socket Reading","operationId":"socket_reading_iot_socket_reading_post","parameters":[{"name":"x-trivon-principal","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Trivon-Principal"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReadingRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReadingResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/iot/socket/action":{"post":{"summary":"Socket Action","operationId":"socket_action_iot_socket_action_post","parameters":[{"name":"x-trivon-principal","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Trivon-Principal"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/ops/launch":{"get":{"summary":"Launch Page","description":"The launch checklist, rendered from the SAME data the predicate decides on.\n\nRead-only and server-rendered: a readiness page that needs client-side scripting to\nsay whether the platform is ready fails in exactly the conditions it exists to\nreport.","operationId":"launch_page_ops_launch_get","responses":{"200":{"description":"Successful Response","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/status":{"get":{"summary":"Status Page","description":"The public status page. Always 200 — the PAGE is up; the BODY reports the system.\n\nReturning a non-200 here would be self-defeating: a status page that goes unreachable\nwhen the system is unhealthy tells a reader nothing at the moment they need it most.\nThe machine-readable de-routing signal is /health's 503, which is a different job.","operationId":"status_page_status_get","responses":{"200":{"description":"Successful Response","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/portal/api/work-queue/items":{"get":{"summary":"List Items","description":"`scope=active` (default) — pending targeting me or claimed by me; `scope=\nwatching` — every item targeting me regardless of state (S7-WQ-03's own split,\nB7). Org-wide oversight views are a later admin-console increment; this endpoint\nis the principal-scoped surface PS-19-01's \"decided from the queue\" slice needs.","operationId":"list_items_portal_api_work_queue_items_get","parameters":[{"name":"scope","in":"query","required":false,"schema":{"type":"string","default":"active","title":"Scope"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response List Items Portal Api Work Queue Items Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/work-queue/items/{item_id}/claim":{"post":{"summary":"Claim Item","operationId":"claim_item_portal_api_work_queue_items__item_id__claim_post","parameters":[{"name":"item_id","in":"path","required":true,"schema":{"type":"string","title":"Item Id"}},{"name":"instance_id","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Instance Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Claim Item Portal Api Work Queue Items  Item Id  Claim Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/work-queue/items/{item_id}/release":{"post":{"summary":"Release Item","operationId":"release_item_portal_api_work_queue_items__item_id__release_post","parameters":[{"name":"item_id","in":"path","required":true,"schema":{"type":"string","title":"Item Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Release Item Portal Api Work Queue Items  Item Id  Release Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/work-queue/items/{item_id}/reassign":{"post":{"summary":"Reassign Item","operationId":"reassign_item_portal_api_work_queue_items__item_id__reassign_post","parameters":[{"name":"item_id","in":"path","required":true,"schema":{"type":"string","title":"Item Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReassignRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Reassign Item Portal Api Work Queue Items  Item Id  Reassign Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/work-queue/bulk":{"post":{"summary":"Bulk Action","description":"S7-WQ-05 — capped, itemized. See work_queue.bulk_action's own doc for the\nall-or-nothing pre-checks (cap, release_approval) vs per-item execution.","operationId":"bulk_action_portal_api_work_queue_bulk_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Bulk Action Portal Api Work Queue Bulk Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/work-queue/subscriptions":{"post":{"summary":"Subscribe","operationId":"subscribe_portal_api_work_queue_subscriptions_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscribeRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Subscribe Portal Api Work Queue Subscriptions Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/work-queue/subscriptions/{subscription_id}":{"delete":{"summary":"Unsubscribe","operationId":"unsubscribe_portal_api_work_queue_subscriptions__subscription_id__delete","parameters":[{"name":"subscription_id","in":"path","required":true,"schema":{"type":"string","title":"Subscription Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Unsubscribe Portal Api Work Queue Subscriptions  Subscription Id  Delete"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/work-queue/route-decision":{"post":{"summary":"Route Decision","description":"The PS-19-01 stand-in: resolve (B4) THEN create (B3), atomically. This is the\nSAME two-call pipeline B5's eventual live Gate-C convergence will drive from the\ngateway/`/ask` doors — B5 itself stays HELD (the ratified plan + this session's\nexplicit instruction); this endpoint proves the queue-side half is fully wired\nend-to-end without it.","operationId":"route_decision_portal_api_work_queue_route_decision_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RouteDecisionRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Route Decision Portal Api Work Queue Route Decision Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/knowledge-graph/entities":{"post":{"summary":"Post Knowledge Graph Entity","description":"Store or update one cited graph fact for the admin's tenant.","operationId":"post_knowledge_graph_entity_admin_api_knowledge_graph_entities_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KnowledgeGraphEntityRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Knowledge Graph Entity Admin Api Knowledge Graph Entities Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/knowledge-graph/edges":{"post":{"summary":"Post Knowledge Graph Edge","description":"Store or update one cited typed edge between two stored graph facts.","operationId":"post_knowledge_graph_edge_admin_api_knowledge_graph_edges_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KnowledgeGraphEdgeRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Knowledge Graph Edge Admin Api Knowledge Graph Edges Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/knowledge/synthesize":{"post":{"summary":"Post Knowledge Synthesis","description":"Answer from the tenant's stored graph neighborhood, with per-claim citations.","operationId":"post_knowledge_synthesis_portal_api_knowledge_synthesize_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/KnowledgeSynthesisRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Post Knowledge Synthesis Portal Api Knowledge Synthesize Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/api/surface-inventory":{"get":{"summary":"Get Surface Inventory","operationId":"get_surface_inventory_admin_api_surface_inventory_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/voice/interaction":{"post":{"summary":"Voice Interaction","operationId":"voice_interaction_portal_api_voice_interaction_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VoiceInteractionRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/portal/api/voice/readback/{transcript_id}":{"post":{"summary":"Voice Readback","operationId":"voice_readback_portal_api_voice_readback__transcript_id__post","parameters":[{"name":"transcript_id","in":"path","required":true,"schema":{"type":"string","title":"Transcript Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VoiceReadbackRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/health":{"get":{"summary":"Health","description":"Liveness + DB-readiness for the ALB / Docker HEALTHCHECK.\n\nBoth the CDK target group (healthy_http_codes=\"200\") and the Docker\nHEALTHCHECK (status==200) route traffic ONLY on a 200 — any other status\nde-routes. So the status code IS the readiness signal, and it must be honest:\n\n  * DB reachable          -> 200, db:true   (the real SELECT 1 answered)\n  * DB configured but DEAD -> 503, db:false  (the dangerous case — de-route,\n                             so the ALB stops sending traffic to a pod whose\n                             database is down; this is the false-green fix)\n  * no DB configured       -> 200, db:false  (disk-KB dev mode is a VALID \"up\"\n                             state — the service still serves; do NOT conflate\n                             \"no DB\" with \"DB dead\")\n\n``db`` is the probe result, never db.is_enabled() (which only says a DSN is\nset, never that the DB answered — that was the bug). See db.db_health().","operationId":"health_health_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/auth/login":{"post":{"summary":"Auth Login","operationId":"auth_login_auth_login_post","parameters":[{"name":"user-agent","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"User-Agent"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LoginRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LoginResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/external/assertion":{"post":{"summary":"Auth External Assertion","operationId":"auth_external_assertion_auth_external_assertion_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAssertionRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAssertionResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/logout":{"post":{"summary":"Auth Logout","operationId":"auth_logout_auth_logout_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/claim-invite":{"post":{"summary":"Auth Claim Invite","description":"TRI-ORG-5: claim a pending invite as an ALREADY-EXISTING account (a `users` row\nexists for the invited email). Possession of the token is the capability -- the same\ntrust model as /auth/verify-email / password reset. Does NOT mint a session; the\ncaller logs in separately afterward. Public: reached by an unauthenticated client\nholding a token, exactly like the email-verification confirm route.","operationId":"auth_claim_invite_auth_claim_invite_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClaimInviteRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClaimInviteResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/claim-invite/register":{"post":{"summary":"Auth Claim Invite Register","description":"TRI-ORG-5: claim a pending invite by CREATING a new account (no `users` row exists\nyet for the invited email). SEC-PS-04/05 password policy applies (the SAME layer\nadmin.register / recovery.reset_password call — no second, weaker rule); checked\nBEFORE the claim so a rejected password never burns the single-use token. The new\naccount's email_verified stays false (SEC-PS-18 is a separate step). Does NOT mint a\nsession; the caller logs in separately afterward.","operationId":"auth_claim_invite_register_auth_claim_invite_register_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClaimInviteNewAccountRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClaimInviteResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/step-up":{"post":{"summary":"Auth Step Up","description":"Re-authenticate the CURRENT session for a short dangerous-action window.\n\nThe session is derived from the bearer/cookie credential, never from the body. Password is\nalways required; an active TOTP factor adds the same one-time-code replay guard login uses.","operationId":"auth_step_up_auth_step_up_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUpRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUpResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/signout-everywhere":{"post":{"summary":"Auth Signout Everywhere","description":"SEC-PS-14 — the logged-in user kills ALL of their OWN sessions, every device.\n\nAUTHENTICATED: the caller is resolved through the ONE validation path before anything is\nrevoked, and the user whose sessions die is taken FROM THAT VALIDATED SESSION — never from\na body field or a query parameter. There is no way to spell \"someone else\" here; an\nunauthenticated call is refused 401 and revokes nothing.\n\nCSRF-ENROLLED BY CONSTRUCTION, not by a decision made here: this is a state-changing POST\nthat is absent from session_transport.EXEMPT_PATHS and from FORM_CSRF_PATHS, so the\nmiddleware demands the X-Trivon-CSRF echo on the cookie transport exactly as it does for\nevery other write. A hostile page cannot drive an authenticated browser into logging\nitself out. (A machine/Bearer caller is CSRF-immune by construction and unaffected.)\n\nTHE MECHANISM IS THE EXISTING ONE (see box_b/auth.signout_everywhere): the membership-epoch\nbump that already kills every session on a completed password reset. The CALLING session is\nkilled with the rest — it was minted at the pre-bump epoch, so its next request 401s\n'stale'. The Set-Cookie clear below is only the browser-side tidy-up; the session is dead\nserver-side whether or not the client honours it, which is what makes a saved-copy replay\nfail too.","operationId":"auth_signout_everywhere_auth_signout_everywhere_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/signout-others":{"post":{"summary":"Auth Signout Others","description":"SEC-PS-14 — the logged-in user kills their OTHER devices and KEEPS this one.\n\nThe sibling of /auth/signout-everywhere and the half of the clause that a plain epoch\nbump cannot express: every other session dies, THIS one continues on the SAME token, so\nthe user is not locked out of the device they are holding while evicting a stolen one.\n\nONE SESSION READ, NO NEW PATH (Law 4). The caller is resolved through the SAME\nauth.authenticate every other route uses, and the token to SPARE is the very credential\nthat request authenticated with — `_bearer(authorization)`, exactly as /auth/logout reads\nit. On the cookie transport that header is the one SessionTransportMiddleware injected\nfrom the session cookie, so the middleware's `count != 1` fail-closed rule governs this\nroute with NO exception carved for it: a duplicate/shadow session cookie yields no\ninjected credential, which lands here as an unauthenticated call and 401s having revoked\nnothing. Nothing is read from the body or the query string — a caller cannot spell\n\"someone else\" here, only \"my other sessions\".\n\nCSRF-ENROLLED BY CONSTRUCTION: a state-changing POST absent from both\nsession_transport.EXEMPT_PATHS and FORM_CSRF_PATHS, so the middleware demands the\nX-Trivon-CSRF echo like every other cookie-transport write. POST-only by declaration —\na GET is refused 405 by the router, so this can never ride a link or an <img> tag.\n\nNO Set-Cookie: the caller's session is deliberately still alive, so clearing its cookie\nhere would log out the one device this endpoint exists to preserve.","operationId":"auth_signout_others_auth_signout_others_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/sessions":{"get":{"summary":"Auth List Sessions","description":"SESSION-VISIBILITY — the caller SEES their own sessions.\n\nThe missing half of session management. /auth/signout-everywhere and /auth/signout-others\ncould already kill sessions, but nothing could SHOW them, so every revocation was a blind\none: a user who suspected a stolen session had to nuke all of them because they could not\npoint at the one that worried them. This route is what makes the targeted kill usable.\n\nONE SESSION READ, NO NEW PATH (Law 4): the caller is resolved through the SAME\nauth.authenticate every other route uses, and the user whose sessions are listed is taken\nfrom THAT validated Identity — never from a query parameter or a body field. There is no\nway to spell \"someone else's sessions\" here.\n\nNO TOKEN HASH LEAVES THIS ROUTE, IN ANY FORM. The definer does not select the column, so\nthere is nothing in the rows to redact and no serializer that could re-add it. Sessions are\nnamed by `session_id`, a random surrogate that exists for exactly this purpose. A test\nasserts this against the SERIALIZED response body with the real hashes pulled from the DB —\nthe claim is checked where it could actually fail, not where it is written down.\n\nGET, and safe: it changes nothing, so it takes no CSRF echo (the middleware only guards\nstate-changing methods). The kill next door is a POST for the opposite reason.","operationId":"auth_list_sessions_auth_sessions_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/sessions/{session_id}/revoke":{"post":{"summary":"Auth Revoke One Session","description":"SESSION-VISIBILITY — the caller kills EXACTLY ONE of their own sessions.\n\nThe third revocation clause, and the one the other two could not express: everywhere,\neverywhere-but-here, and — now — precisely that one. Paired with GET /auth/sessions above,\nwhich is where the session_id comes from.\n\nTHE OWNER SCOPE IS THE SECURITY PROPERTY. `user_id` comes from the validated Identity and\nis applied in the SAME DELETE statement as the session_id (auth_revoke_session_by_id), so\npresenting ANOTHER user's session_id deletes nothing and returns revoked=false. It does not\n404 differently, does not error, and does not distinguish \"not yours\" from \"no such\nsession\" — a caller learns nothing about sessions that are not theirs. A session_id is\nhanded out by the list surface and is therefore NOT a secret; the guard is ownership, never\nunguessability. This is asserted live, and the assertion is proven load-bearing by deleting\nthe scope conjunct and watching the test go red.\n\nCSRF-ENROLLED BY CONSTRUCTION, not by a decision made here: a state-changing POST absent\nfrom BOTH session_transport.EXEMPT_PATHS and FORM_CSRF_PATHS, so the middleware demands the\nX-Trivon-CSRF echo on the cookie transport exactly as it does for every other write.\nPOST-only by declaration — a GET is refused 405 by the router — so this can never ride a\nlink or an <img> tag.\n\nREVOKING YOUR OWN CURRENT SESSION IS A LOGOUT, AND IS THE EXISTING ONE. When the session\nnamed is the one in the caller's hand, the response clears the cookies exactly as\n/auth/logout does. That branch is decided BEFORE the delete — afterwards the row is gone\nand the question could no longer be answered — and it is the same clear_session_cookies\ncall, not a second logout invented here (Law 4). As with logout, the cookie clear happens\nonly when the request actually rode the cookies; a Bearer/machine caller gets no\nSet-Cookie back.","operationId":"auth_revoke_one_session_auth_sessions__session_id__revoke_post","parameters":[{"name":"session_id","in":"path","required":true,"schema":{"type":"string","title":"Session Id"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/totp":{"get":{"summary":"Auth Totp Status","operationId":"auth_totp_status_auth_mfa_totp_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TotpStatusResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/totp/setup":{"post":{"summary":"Auth Totp Setup","operationId":"auth_totp_setup_auth_mfa_totp_setup_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TotpSetupRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TotpSetupResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/totp/confirm":{"post":{"summary":"Auth Totp Confirm","operationId":"auth_totp_confirm_auth_mfa_totp_confirm_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TotpConfirmRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/totp/disable":{"post":{"summary":"Auth Totp Disable","operationId":"auth_totp_disable_auth_mfa_totp_disable_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TotpDisableRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/passkeys":{"get":{"summary":"Auth Passkey Status","operationId":"auth_passkey_status_auth_mfa_passkeys_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyStatusResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/passkeys/register/options":{"post":{"summary":"Auth Passkey Register Options","operationId":"auth_passkey_register_options_auth_mfa_passkeys_register_options_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyRegistrationStartResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/passkeys/register/confirm":{"post":{"summary":"Auth Passkey Register Confirm","operationId":"auth_passkey_register_confirm_auth_mfa_passkeys_register_confirm_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyRegistrationConfirmRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyRegistrationConfirmResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/passkeys/assert/options":{"post":{"summary":"Auth Passkey Assert Options","operationId":"auth_passkey_assert_options_auth_mfa_passkeys_assert_options_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyAssertionStartRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyAssertionStartResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/passkeys/assert/confirm":{"post":{"summary":"Auth Passkey Assert Confirm","operationId":"auth_passkey_assert_confirm_auth_mfa_passkeys_assert_confirm_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyAssertionConfirmRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/mfa/recovery-codes":{"get":{"summary":"Auth Recovery Codes Status","operationId":"auth_recovery_codes_status_auth_mfa_recovery_codes_get","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecoveryCodesStatusResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"summary":"Auth Recovery Codes Create","operationId":"auth_recovery_codes_create_auth_mfa_recovery_codes_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecoveryCodesCreateRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecoveryCodesResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"delete":{"summary":"Auth Recovery Codes Clear","operationId":"auth_recovery_codes_clear_auth_mfa_recovery_codes_delete","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/request-reset":{"post":{"summary":"Auth Request Reset","description":"Request a password-reset mail. ENUMERATION-SAFE by construction (SEC-PS-19/24):\n\nthe response is the SAME constant body for an existing, unknown, or unverified\naddress, and ALL account-dependent work (lookup, token issue, provider send)\nruns OFF the request path in a worker thread — so neither the response bytes\nnor the response latency can leak whether the account exists, even when the\nbackend/provider is slow (structural equalization, the login-hash-equalizer's\nstronger sibling). The thread pool is bounded by the two rate limits in front:\nper-IP (the perimeter mount) and per-email (the bucket here — checked for every\naddress alike, so a 429 is not an existence oracle either).","operationId":"auth_request_reset_auth_request_reset_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResetRequestBody"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Auth Request Reset Auth Request Reset Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/confirm-reset":{"post":{"summary":"Auth Confirm Reset","description":"Complete a reset: new credential (Argon2id, the existing >=8 rule) + every\nprior session of the principal refused 'stale' — both enforced in the ONE\natomic consume definer (single-use + expiry in its WHERE). A weak password is\nrefused BEFORE the consume (a typo never burns the single-use token); an\nunknown/used/expired token gets ONE generic refusal (no oracle which).","operationId":"auth_confirm_reset_auth_confirm_reset_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfirmResetBody"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Auth Confirm Reset Auth Confirm Reset Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/confirm-reset/recovery-code":{"post":{"summary":"Auth Confirm Reset Recovery Code","description":"Layer-2 recovery: reset-token possession plus one active one-time recovery code.","operationId":"auth_confirm_reset_recovery_code_auth_confirm_reset_recovery_code_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfirmResetWithRecoveryCodeBody"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Auth Confirm Reset Recovery Code Auth Confirm Reset Recovery Code Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/request-assisted-recovery":{"post":{"summary":"Auth Request Assisted Recovery","operationId":"auth_request_assisted_recovery_auth_request_assisted_recovery_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssistedRecoveryRequestBody"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Auth Request Assisted Recovery Auth Request Assisted Recovery Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/auth/confirm-assisted-recovery":{"post":{"summary":"Auth Confirm Assisted Recovery","operationId":"auth_confirm_assisted_recovery_auth_confirm_assisted_recovery_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfirmResetBody"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Auth Confirm Assisted Recovery Auth Confirm Assisted Recovery Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/ask":{"post":{"summary":"Ask","operationId":"ask_ask_post","parameters":[{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AskRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AskResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}}},"components":{"schemas":{"ActionRequest":{"properties":{"tenant_id":{"type":"string","title":"Tenant Id"},"device_id":{"type":"string","title":"Device Id"},"action":{"type":"string","title":"Action"},"target_ref":{"type":"string","title":"Target Ref"},"params":{"additionalProperties":true,"type":"object","title":"Params","default":{}},"question":{"type":"string","title":"Question","default":""}},"type":"object","required":["tenant_id","device_id","action","target_ref"],"title":"ActionRequest"},"ActionResponse":{"properties":{"answer":{"type":"string","title":"Answer"},"citation":{"type":"string","title":"Citation"},"governance_outcome":{"type":"string","title":"Governance Outcome"},"path":{"type":"string","title":"Path"},"acted":{"type":"boolean","title":"Acted"},"audit_ref":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Audit Ref"}},"type":"object","required":["answer","citation","governance_outcome","path","acted","audit_ref"],"title":"ActionResponse"},"AddMembershipRequest":{"properties":{"target_user_id":{"type":"string","title":"Target User Id"},"role":{"type":"string","title":"Role"}},"type":"object","required":["target_user_id","role"],"title":"AddMembershipRequest"},"AdminTerminateSessionsRequest":{"properties":{"reason":{"type":"string","title":"Reason","default":""}},"type":"object","title":"AdminTerminateSessionsRequest"},"AgentInstanceRetireRequest":{"properties":{"reason":{"type":"string","title":"Reason","default":"retired"}},"type":"object","title":"AgentInstanceRetireRequest"},"AgentInstanceSpawnRequest":{"properties":{"cem_identity":{"type":"string","title":"Cem Identity"},"instance_labels":{"additionalProperties":true,"type":"object","title":"Instance Labels","default":{}}},"type":"object","required":["cem_identity"],"title":"AgentInstanceSpawnRequest"},"ApiKeyCreateRequest":{"properties":{"principal_id":{"type":"string","title":"Principal Id","default":""},"scopes":{"items":{"type":"string"},"type":"array","title":"Scopes"}},"type":"object","title":"ApiKeyCreateRequest"},"ApiKeyRevokeRequest":{"properties":{"credential_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Credential Id"},"reason":{"type":"string","title":"Reason","default":"revoked"}},"type":"object","title":"ApiKeyRevokeRequest"},"ApiKeyRotateRequest":{"properties":{"overlap_seconds":{"type":"integer","title":"Overlap Seconds","default":300}},"type":"object","title":"ApiKeyRotateRequest"},"AskRequest":{"properties":{"question":{"type":"string","maxLength":65536,"title":"Question"},"user_role":{"type":"string","maxLength":256,"title":"User Role","default":""},"user_competencies":{"items":{"type":"string","maxLength":256},"type":"array","maxItems":256,"title":"User Competencies","default":[]}},"type":"object","required":["question"],"title":"AskRequest"},"AskResponse":{"properties":{"answer":{"type":"string","title":"Answer"},"citation":{"type":"string","title":"Citation"},"status":{"type":"string","title":"Status"},"audit_ref":{"type":"string","title":"Audit Ref","default":""},"audit_status":{"type":"string","title":"Audit Status","default":""},"presentation_mode":{"type":"string","title":"Presentation Mode","default":"normal"},"adaptive_profile":{"type":"string","title":"Adaptive Profile","default":"fast_mode"},"adaptive_profile_render_key":{"type":"string","title":"Adaptive Profile Render Key","default":"fast"},"presentation_effects":{"additionalProperties":true,"type":"object","title":"Presentation Effects"}},"type":"object","required":["answer","citation","status"],"title":"AskResponse"},"AssignmentRunRequest":{"properties":{"cem_identity":{"type":"string","title":"Cem Identity"},"assignment_ref":{"type":"string","title":"Assignment Ref","default":""},"trust_context":{"additionalProperties":true,"type":"object","title":"Trust Context"}},"type":"object","required":["cem_identity"],"title":"AssignmentRunRequest","description":"Compute and persist one CEM assignment acceptance-axis run."},"AssistedRecoveryApproveRequest":{"properties":{"request_id":{"type":"string","title":"Request Id"},"operator_token":{"type":"string","title":"Operator Token","default":""}},"type":"object","required":["request_id"],"title":"AssistedRecoveryApproveRequest"},"AssistedRecoveryRequestBody":{"properties":{"email":{"type":"string","maxLength":320,"title":"Email"},"evidence_ref":{"type":"string","maxLength":512,"title":"Evidence Ref","default":""}},"type":"object","required":["email"],"title":"AssistedRecoveryRequestBody"},"AuthorityRequest":{"properties":{"decision_key":{"type":"string","title":"Decision Key"},"authority_label":{"type":"string","title":"Authority Label"},"owner_roles":{"items":{"type":"string"},"type":"array","title":"Owner Roles"},"citation":{"type":"string","title":"Citation"},"rule":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Rule"}},"type":"object","required":["decision_key","authority_label","owner_roles","citation"],"title":"AuthorityRequest"},"BackupRouteRequest":{"properties":{"primary_principal_id":{"type":"string","title":"Primary Principal Id","default":""},"backup_principal_id":{"type":"string","title":"Backup Principal Id","default":""},"capability_key":{"type":"string","title":"Capability Key","default":""},"reason":{"type":"string","title":"Reason","default":""},"audit_ref":{"type":"string","title":"Audit Ref","default":""}},"type":"object","title":"BackupRouteRequest"},"BulkRequest":{"properties":{"action":{"type":"string","title":"Action"},"item_ids":{"items":{"type":"string"},"type":"array","title":"Item Ids"},"new_principal_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"New Principal Id"},"reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Reason"}},"type":"object","required":["action","item_ids"],"title":"BulkRequest"},"CemAuthorRequest":{"properties":{"spec":{"additionalProperties":true,"type":"object","title":"Spec"},"tier":{"type":"string","title":"Tier"},"rule":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Rule"}},"type":"object","required":["spec","tier"],"title":"CemAuthorRequest","description":"Author / re-author a governed agent. `spec` is the 11-field CEM dict (conform() runs\nover it, reused not rebuilt); `tier` is earned | attested | never_autonomous; `rule` is\nthe success-rule spec REQUIRED for the earned tier (it runs the §2 validity gate)."},"ChangeMembershipRoleRequest":{"properties":{"role":{"type":"string","title":"Role"}},"type":"object","required":["role"],"title":"ChangeMembershipRoleRequest"},"ClaimInviteNewAccountRequest":{"properties":{"token":{"type":"string","maxLength":512,"title":"Token"},"password":{"type":"string","title":"Password"}},"type":"object","required":["token","password"],"title":"ClaimInviteNewAccountRequest"},"ClaimInviteRequest":{"properties":{"token":{"type":"string","maxLength":512,"title":"Token"}},"type":"object","required":["token"],"title":"ClaimInviteRequest"},"ClaimInviteResponse":{"properties":{"tenant_id":{"type":"string","title":"Tenant Id"},"role":{"type":"string","title":"Role"},"user_id":{"type":"string","title":"User Id"}},"type":"object","required":["tenant_id","role","user_id"],"title":"ClaimInviteResponse"},"ConfirmResetBody":{"properties":{"token":{"type":"string","maxLength":1024,"title":"Token"},"new_password":{"type":"string","title":"New Password"}},"type":"object","required":["token","new_password"],"title":"ConfirmResetBody"},"ConfirmResetWithRecoveryCodeBody":{"properties":{"token":{"type":"string","maxLength":1024,"title":"Token"},"new_password":{"type":"string","title":"New Password"},"recovery_code":{"type":"string","maxLength":128,"title":"Recovery Code"}},"type":"object","required":["token","new_password","recovery_code"],"title":"ConfirmResetWithRecoveryCodeBody"},"CutoverRequest":{"properties":{"successor":{"type":"string","title":"Successor","default":""}},"type":"object","title":"CutoverRequest"},"DemoLiveRequest":{"properties":{"question":{"type":"string","maxLength":1000,"minLength":1,"title":"Question"},"user_role":{"type":"string","maxLength":80,"title":"User Role","default":""},"user_competencies":{"items":{"type":"string"},"type":"array","title":"User Competencies"}},"type":"object","required":["question"],"title":"DemoLiveRequest"},"DingDongRequest":{"properties":{"offer_text":{"type":"string","title":"Offer Text"},"session_bell_count":{"type":"integer","title":"Session Bell Count","default":0},"accept":{"type":"boolean","title":"Accept","default":false}},"type":"object","required":["offer_text"],"title":"DingDongRequest"},"DisclosurePackExportRequest":{"properties":{"sku":{"type":"string","title":"Sku"},"pack_id":{"type":"string","title":"Pack Id"},"profile_key":{"type":"string","title":"Profile Key"},"framework_key":{"type":"string","title":"Framework Key"},"claim_language":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Claim Language"},"corpus":{"additionalProperties":true,"type":"object","title":"Corpus"},"accuracy_by_window":{"additionalProperties":true,"type":"object","title":"Accuracy By Window"},"failure_modes":{"items":{"additionalProperties":true,"type":"object"},"type":"array","title":"Failure Modes"},"replay_record":{"additionalProperties":true,"type":"object","title":"Replay Record"},"marketing_text":{"type":"string","title":"Marketing Text","default":""}},"type":"object","required":["sku","pack_id","profile_key","framework_key"],"title":"DisclosurePackExportRequest"},"EvidencePackAssembleRequest":{"properties":{"decision_id":{"type":"string","title":"Decision Id","default":""},"audit_ref":{"type":"string","title":"Audit Ref","default":""},"record_id":{"type":"string","title":"Record Id","default":""},"scope_key":{"type":"string","title":"Scope Key","default":""},"window_start":{"type":"string","title":"Window Start","default":""},"window_end":{"type":"string","title":"Window End","default":""}},"type":"object","title":"EvidencePackAssembleRequest"},"ExternalAssertionRequest":{"properties":{"method":{"type":"string","maxLength":64,"title":"Method"},"assertion":{"additionalProperties":true,"type":"object","title":"Assertion"},"expected_audience":{"anyOf":[{"type":"string","maxLength":2048},{"type":"null"}],"title":"Expected Audience"}},"type":"object","required":["method","assertion"],"title":"ExternalAssertionRequest"},"ExternalAssertionResponse":{"properties":{"principal_id":{"type":"string","title":"Principal Id"},"method":{"type":"string","title":"Method"},"handle":{"type":"string","title":"Handle"}},"type":"object","required":["principal_id","method","handle"],"title":"ExternalAssertionResponse"},"FirstLoginHireRequest":{"properties":{"intake":{"additionalProperties":true,"type":"object","title":"Intake"},"deferred":{"additionalProperties":true,"type":"object","title":"Deferred"},"idempotency_key":{"type":"string","title":"Idempotency Key","default":""}},"type":"object","required":["intake"],"title":"FirstLoginHireRequest"},"FleetFailureTelemetryRequest":{"properties":{"cem_identity":{"type":"string","title":"Cem Identity"},"rung_before":{"type":"integer","title":"Rung Before","default":3},"severity":{"type":"string","title":"Severity","default":"failure"},"failure_ref":{"type":"string","title":"Failure Ref","default":""},"reason":{"additionalProperties":true,"type":"object","title":"Reason","default":{}}},"type":"object","required":["cem_identity"],"title":"FleetFailureTelemetryRequest","description":"Record one fleet failure event as demotion-only provenance."},"FleetTelemetryContractRequest":{"properties":{"telemetry_status":{"type":"string","title":"Telemetry Status"},"reason":{"additionalProperties":true,"type":"object","title":"Reason","default":{}}},"type":"object","required":["telemetry_status"],"title":"FleetTelemetryContractRequest","description":"Append the latest tenant fleet-failure telemetry/default contract."},"GatewayLookupRequest":{"properties":{"actor_identity":{"type":"string","maxLength":256,"title":"Actor Identity"},"actor_role":{"type":"string","maxLength":256,"title":"Actor Role"},"tenant_id":{"type":"string","maxLength":256,"title":"Tenant Id"},"question":{"type":"string","maxLength":65536,"title":"Question"},"audit_touch":{"type":"string","maxLength":256,"title":"Audit Touch","default":"World-1"},"source_surface":{"type":"string","maxLength":256,"title":"Source Surface","default":""}},"type":"object","required":["actor_identity","actor_role","tenant_id","question"],"title":"GatewayLookupRequest","description":"The LOOKUP handoff contract — SAME field names as the decision door (one name per thing),\nminus the decision-only `intent`/`context`; the informational `question` is required here."},"GatewayRequest":{"properties":{"actor_identity":{"type":"string","maxLength":256,"title":"Actor Identity"},"actor_role":{"type":"string","maxLength":256,"title":"Actor Role"},"tenant_id":{"type":"string","maxLength":256,"title":"Tenant Id"},"intent":{"type":"string","maxLength":256,"title":"Intent"},"context":{"additionalProperties":true,"type":"object","title":"Context","default":{}},"audit_touch":{"type":"string","maxLength":256,"title":"Audit Touch","default":"World-1"},"source_surface":{"type":"string","maxLength":256,"title":"Source Surface","default":""},"question":{"type":"string","maxLength":65536,"title":"Question","default":""}},"type":"object","required":["actor_identity","actor_role","tenant_id","intent"],"title":"GatewayRequest"},"GatewayResponse":{"properties":{"answer":{"type":"string","title":"Answer"},"citations":{"items":{"type":"string"},"type":"array","title":"Citations"},"governance_outcome":{"type":"string","title":"Governance Outcome"},"audit_ref":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Audit Ref"}},"type":"object","required":["answer","citations","governance_outcome","audit_ref"],"title":"GatewayResponse"},"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"HardenRequest":{"properties":{"rule":{"additionalProperties":true,"type":"object","title":"Rule"},"candidate_ref":{"type":"string","title":"Candidate Ref","default":""}},"type":"object","required":["rule"],"title":"HardenRequest","description":"AGT-003 landing (b): harden a ratified capture candidate into a CEM rule edit. `rule` is the\nNEW success-rule spec; `candidate_ref` is the capture candidate id (provenance)."},"HorizonCheckRequest":{"properties":{"question":{"type":"string","title":"Question"},"hits":{"items":{"additionalProperties":true,"type":"object"},"type":"array","title":"Hits","default":[]}},"type":"object","required":["question"],"title":"HorizonCheckRequest"},"IssueInviteRequest":{"properties":{"email":{"type":"string","title":"Email"},"role":{"type":"string","title":"Role"},"claim_mode":{"type":"string","title":"Claim Mode","default":"email"}},"type":"object","required":["email","role"],"title":"IssueInviteRequest"},"KbDispositionRequest":{"properties":{"reason":{"type":"string","title":"Reason","default":""}},"type":"object","title":"KbDispositionRequest","description":"Promote/reject a staged KB doc. `reason` is the mandatory disposition\nprovenance (who is the admin session; why is this)."},"KbRequest":{"properties":{"source":{"type":"string","title":"Source"},"title":{"type":"string","title":"Title"},"content":{"type":"string","title":"Content"},"file_name":{"type":"string","title":"File Name","default":""}},"type":"object","required":["source","title","content"],"title":"KbRequest"},"KbUploadRequest":{"properties":{"source":{"type":"string","title":"Source"},"title":{"type":"string","title":"Title"},"file_name":{"type":"string","title":"File Name"},"content_b64":{"type":"string","title":"Content B64"}},"type":"object","required":["source","title","file_name","content_b64"],"title":"KbUploadRequest","description":"Load a REAL DOCUMENT FILE into the KB — the same write as `KbRequest`, with\nthe `content` string produced by extracting text from an uploaded PDF/DOCX\ninstead of pasted by hand.\n\nThe three governed fields are IDENTICAL to `KbRequest` on purpose: `source` is\nstill the mandatory `§x.y` citation token, `title` is still mandatory, and the\nextracted text still goes through `admin.add_kb`, which applies every rule it\nalways has (citation shape, non-empty title, minimum length, the appended\n`Source: §x` line) and stages the result in PROBATION. This request adds ONE\nfield and removes none.\n\nWHY BASE64 IN THE JSON BODY, and not a multipart form. A multipart upload needs\n`python-multipart`, a dependency this codebase has twice declined by name\n(`ask_page.py`, `public_ask.py`) and parses form bodies with the stdlib instead.\nBase64 in the existing JSON envelope keeps the contract one shape — a pydantic\nmodel, validated the same way, appearing in the OpenAPI schema like every other\nadmin write — at the cost of 4/3 the bytes on the wire. That cost is bounded and\nstated: see `document_text.MAX_DOCUMENT_BYTES`, which sits UNDER the perimeter's\nexisting `GLOBAL_MAX_BODY_BYTES` rather than asking anyone to widen it."},"KillRequest":{"properties":{"scope":{"type":"string","title":"Scope"},"target":{"type":"string","title":"Target","default":""},"operator_token":{"type":"string","title":"Operator Token","default":""}},"type":"object","required":["scope"],"title":"KillRequest"},"KnowledgeGraphEdgeRequest":{"properties":{"source_entity_key":{"type":"string","title":"Source Entity Key"},"target_entity_key":{"type":"string","title":"Target Entity Key"},"edge_kind":{"type":"string","title":"Edge Kind"},"provenance":{"type":"string","title":"Provenance"},"citation":{"type":"string","title":"Citation"},"source_span":{"type":"string","title":"Source Span"},"status":{"type":"string","title":"Status","default":"active"},"valid_from":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Valid From"},"valid_to":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Valid To"}},"type":"object","required":["source_entity_key","target_entity_key","edge_kind","provenance","citation","source_span"],"title":"KnowledgeGraphEdgeRequest"},"KnowledgeGraphEntityRequest":{"properties":{"entity_key":{"type":"string","title":"Entity Key"},"entity_kind":{"type":"string","title":"Entity Kind"},"label":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Label"},"fact_text":{"type":"string","title":"Fact Text"},"citation":{"type":"string","title":"Citation"},"source_span":{"type":"string","title":"Source Span"},"status":{"type":"string","title":"Status","default":"active"},"valid_from":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Valid From"},"valid_to":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Valid To"}},"type":"object","required":["entity_key","entity_kind","fact_text","citation","source_span"],"title":"KnowledgeGraphEntityRequest"},"KnowledgeSynthesisRequest":{"properties":{"entity_key":{"type":"string","title":"Entity Key"},"question":{"type":"string","minLength":1,"title":"Question"}},"type":"object","required":["entity_key","question"],"title":"KnowledgeSynthesisRequest"},"LedgerFeedbackRequest":{"properties":{"verdict":{"type":"string","title":"Verdict"},"reason":{"type":"string","title":"Reason","default":""}},"type":"object","required":["verdict"],"title":"LedgerFeedbackRequest"},"LiveDisableRequest":{"properties":{"operator_token":{"type":"string","title":"Operator Token","default":""},"reason":{"type":"string","title":"Reason","default":"owner_disable"}},"type":"object","title":"LiveDisableRequest"},"LiveEnableRequest":{"properties":{"ttl_seconds":{"type":"integer","title":"Ttl Seconds","default":3600},"approval_basis":{"type":"string","title":"Approval Basis","default":""},"operator_token":{"type":"string","title":"Operator Token","default":""},"rate_limit":{"type":"integer","title":"Rate Limit","default":60},"rate_window_seconds":{"type":"integer","title":"Rate Window Seconds","default":3600}},"type":"object","title":"LiveEnableRequest"},"LoginRequest":{"properties":{"email":{"type":"string","maxLength":320,"title":"Email"},"password":{"type":"string","title":"Password"},"tenant":{"type":"string","maxLength":256,"title":"Tenant"},"totp_code":{"anyOf":[{"type":"string","maxLength":32},{"type":"null"}],"title":"Totp Code"},"recovery_code":{"anyOf":[{"type":"string","maxLength":128},{"type":"null"}],"title":"Recovery Code"},"passkey_credential_id":{"anyOf":[{"type":"string","maxLength":2048},{"type":"null"}],"title":"Passkey Credential Id"},"passkey_challenge":{"anyOf":[{"type":"string","maxLength":1024},{"type":"null"}],"title":"Passkey Challenge"},"passkey_assertion":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Passkey Assertion"}},"type":"object","required":["email","password","tenant"],"title":"LoginRequest"},"LoginResponse":{"properties":{"expires_at":{"type":"string","title":"Expires At"},"tenant":{"type":"string","title":"Tenant"},"role":{"type":"string","title":"Role"}},"type":"object","required":["expires_at","tenant","role"],"title":"LoginResponse"},"MtlsCertCreateRequest":{"properties":{"principal_id":{"type":"string","title":"Principal Id"},"cert_der_b64":{"type":"string","title":"Cert Der B64"},"allowed_actions":{"items":{"type":"string"},"type":"array","title":"Allowed Actions"}},"type":"object","required":["principal_id","cert_der_b64"],"title":"MtlsCertCreateRequest"},"MtlsCertRevokeRequest":{"properties":{"reason":{"type":"string","title":"Reason","default":"revoked"}},"type":"object","title":"MtlsCertRevokeRequest"},"NarrowAndTestRequest":{"properties":{"proposal_id":{"type":"string","title":"Proposal Id"},"positions":{"items":{"type":"string"},"type":"array","title":"Positions"}},"type":"object","required":["proposal_id","positions"],"title":"NarrowAndTestRequest"},"ObserveRequest":{"properties":{"scenario":{"type":"string","title":"Scenario","default":"clean"}},"type":"object","title":"ObserveRequest"},"OffboardRequest":{"properties":{"why":{"type":"string","title":"Why","default":""}},"type":"object","title":"OffboardRequest"},"OfferingRequest":{"properties":{"adviser_tier":{"type":"string","title":"Adviser Tier"},"doctrine":{"type":"string","title":"Doctrine","default":"default"}},"type":"object","required":["adviser_tier"],"title":"OfferingRequest"},"OrgSwitchRequest":{"properties":{"target_tenant_id":{"type":"string","title":"Target Tenant Id"}},"type":"object","required":["target_tenant_id"],"title":"OrgSwitchRequest"},"PasskeyAssertionConfirmRequest":{"properties":{"credential_id":{"type":"string","maxLength":2048,"title":"Credential Id"},"challenge":{"type":"string","maxLength":1024,"title":"Challenge"},"assertion":{"additionalProperties":true,"type":"object","title":"Assertion"}},"type":"object","required":["credential_id","challenge","assertion"],"title":"PasskeyAssertionConfirmRequest"},"PasskeyAssertionStartRequest":{"properties":{"credential_id":{"type":"string","maxLength":2048,"title":"Credential Id"}},"type":"object","required":["credential_id"],"title":"PasskeyAssertionStartRequest"},"PasskeyAssertionStartResponse":{"properties":{"challenge":{"type":"string","title":"Challenge"}},"type":"object","required":["challenge"],"title":"PasskeyAssertionStartResponse"},"PasskeyRegistrationConfirmRequest":{"properties":{"challenge":{"type":"string","maxLength":1024,"title":"Challenge"},"attestation":{"additionalProperties":true,"type":"object","title":"Attestation"},"label":{"anyOf":[{"type":"string","maxLength":64},{"type":"null"}],"title":"Label"}},"type":"object","required":["challenge","attestation"],"title":"PasskeyRegistrationConfirmRequest"},"PasskeyRegistrationConfirmResponse":{"properties":{"credential_id":{"type":"string","title":"Credential Id"}},"type":"object","required":["credential_id"],"title":"PasskeyRegistrationConfirmResponse"},"PasskeyRegistrationStartResponse":{"properties":{"challenge":{"type":"string","title":"Challenge"},"principal_id":{"type":"string","title":"Principal Id"}},"type":"object","required":["challenge","principal_id"],"title":"PasskeyRegistrationStartResponse"},"PasskeyStatusResponse":{"properties":{"enabled":{"type":"boolean","title":"Enabled"}},"type":"object","required":["enabled"],"title":"PasskeyStatusResponse"},"ProbeRequest":{"properties":{"actor_role":{"type":"string","title":"Actor Role","default":"qc_lead"},"evidence_present":{"type":"boolean","title":"Evidence Present","default":false}},"type":"object","title":"ProbeRequest"},"ReadingRequest":{"properties":{"tenant_id":{"type":"string","title":"Tenant Id"},"device_id":{"type":"string","title":"Device Id"},"metric":{"type":"string","title":"Metric"},"value":{"anyOf":[{"type":"number"},{"type":"string"},{"type":"null"}],"title":"Value"},"unit":{"type":"string","title":"Unit","default":""},"captured_at":{"type":"string","title":"Captured At","default":""},"source":{"type":"string","title":"Source","default":""},"question":{"type":"string","title":"Question","default":""}},"type":"object","required":["tenant_id","device_id","metric"],"title":"ReadingRequest"},"ReadingResponse":{"properties":{"answer":{"type":"string","title":"Answer"},"citation":{"type":"string","title":"Citation"},"governance_outcome":{"type":"string","title":"Governance Outcome"},"audit_ref":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Audit Ref"}},"type":"object","required":["answer","citation","governance_outcome","audit_ref"],"title":"ReadingResponse"},"ReassignRequest":{"properties":{"new_principal_id":{"type":"string","title":"New Principal Id"},"reason":{"type":"string","title":"Reason"}},"type":"object","required":["new_principal_id","reason"],"title":"ReassignRequest"},"RecoveryCodesCreateRequest":{"properties":{"count":{"type":"integer","maximum":20.0,"minimum":1.0,"title":"Count","default":10}},"type":"object","title":"RecoveryCodesCreateRequest"},"RecoveryCodesResponse":{"properties":{"codes":{"items":{"type":"string"},"type":"array","title":"Codes"}},"type":"object","required":["codes"],"title":"RecoveryCodesResponse"},"RecoveryCodesStatusResponse":{"properties":{"remaining":{"type":"integer","title":"Remaining"}},"type":"object","required":["remaining"],"title":"RecoveryCodesStatusResponse"},"ResetRequestBody":{"properties":{"email":{"type":"string","maxLength":320,"title":"Email"}},"type":"object","required":["email"],"title":"ResetRequestBody"},"RiskPostureAssignmentRequest":{"properties":{"worker_principal_id":{"type":"string","title":"Worker Principal Id"},"position_id":{"type":"string","title":"Position Id"},"cem_identity":{"type":"string","title":"Cem Identity"},"unit_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Unit Id"}},"type":"object","required":["worker_principal_id","position_id","cem_identity"],"title":"RiskPostureAssignmentRequest","description":"Assign a worker after the server reads that CEM's durable rung."},"RiskPostureFloorRequest":{"properties":{"scope":{"type":"string","title":"Scope","default":"tenant"},"min_rung":{"type":"integer","maximum":3.0,"minimum":0.0,"title":"Min Rung","default":0},"cem_identity":{"type":"string","title":"Cem Identity","default":""},"reason":{"type":"string","title":"Reason","default":""}},"type":"object","title":"RiskPostureFloorRequest","description":"Declare a tenant-wide or CEM-specific minimum rung for risk posture."},"RoleRequest":{"properties":{"role_key":{"type":"string","title":"Role Key"},"label":{"type":"string","title":"Label"}},"type":"object","required":["role_key","label"],"title":"RoleRequest"},"RouteDecisionRequest":{"properties":{"decision_key":{"type":"string","title":"Decision Key"},"authority_row":{"additionalProperties":true,"type":"object","title":"Authority Row"},"unit_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Unit Id"},"item_type":{"type":"string","title":"Item Type","default":"approval"},"payload":{"additionalProperties":true,"type":"object","title":"Payload"}},"type":"object","required":["decision_key","authority_row","payload"],"title":"RouteDecisionRequest"},"SandboxRequest":{"properties":{"question":{"type":"string","title":"Question"}},"type":"object","required":["question"],"title":"SandboxRequest"},"ScoreRequest":{"properties":{"outcome":{"type":"string","title":"Outcome"},"case_id":{"type":"string","title":"Case Id","default":""},"evaluation_snapshot_ref":{"type":"string","title":"Evaluation Snapshot Ref","default":""},"ground_truth_source":{"type":"string","title":"Ground Truth Source","default":""}},"type":"object","required":["outcome"],"title":"ScoreRequest","description":"Append one scored case to a CEM's durable accuracy series."},"SignupRequest":{"properties":{"tenant_slug":{"type":"string","title":"Tenant Slug"},"tenant_name":{"type":"string","title":"Tenant Name"},"admin_email":{"type":"string","title":"Admin Email"},"admin_password":{"type":"string","title":"Admin Password"}},"type":"object","required":["tenant_slug","tenant_name","admin_email","admin_password"],"title":"SignupRequest"},"SpendCapRequest":{"properties":{"daily_token_cap":{"type":"integer","title":"Daily Token Cap"}},"type":"object","required":["daily_token_cap"],"title":"SpendCapRequest"},"StandingCheckRequest":{"properties":{"question":{"type":"string","title":"Question"},"hits":{"items":{"additionalProperties":true,"type":"object"},"type":"array","title":"Hits","default":[]}},"type":"object","required":["question"],"title":"StandingCheckRequest"},"StepUpRequest":{"properties":{"password":{"type":"string","title":"Password"},"totp_code":{"anyOf":[{"type":"string","maxLength":32},{"type":"null"}],"title":"Totp Code"},"recovery_code":{"anyOf":[{"type":"string","maxLength":128},{"type":"null"}],"title":"Recovery Code"},"passkey_credential_id":{"anyOf":[{"type":"string","maxLength":2048},{"type":"null"}],"title":"Passkey Credential Id"},"passkey_challenge":{"anyOf":[{"type":"string","maxLength":1024},{"type":"null"}],"title":"Passkey Challenge"},"passkey_assertion":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Passkey Assertion"}},"type":"object","required":["password"],"title":"StepUpRequest"},"StepUpResponse":{"properties":{"reauthenticated_at":{"type":"string","title":"Reauthenticated At"},"step_up_expires_at":{"type":"string","title":"Step Up Expires At"}},"type":"object","required":["reauthenticated_at","step_up_expires_at"],"title":"StepUpResponse"},"SubscribeRequest":{"properties":{"filter_expr":{"additionalProperties":true,"type":"object","title":"Filter Expr","default":{}},"channels":{"items":{"type":"string"},"type":"array","title":"Channels","default":[]}},"type":"object","title":"SubscribeRequest"},"SuspendRequest":{"properties":{"why":{"type":"string","title":"Why","default":""},"until":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Until"}},"type":"object","title":"SuspendRequest"},"TotpConfirmRequest":{"properties":{"code":{"type":"string","maxLength":32,"title":"Code"}},"type":"object","required":["code"],"title":"TotpConfirmRequest"},"TotpDisableRequest":{"properties":{"password":{"type":"string","title":"Password"}},"type":"object","required":["password"],"title":"TotpDisableRequest"},"TotpSetupRequest":{"properties":{"password":{"type":"string","title":"Password"}},"type":"object","required":["password"],"title":"TotpSetupRequest"},"TotpSetupResponse":{"properties":{"secret":{"type":"string","title":"Secret"},"provisioning_uri":{"type":"string","title":"Provisioning Uri"}},"type":"object","required":["secret","provisioning_uri"],"title":"TotpSetupResponse"},"TotpStatusResponse":{"properties":{"enabled":{"type":"boolean","title":"Enabled"}},"type":"object","required":["enabled"],"title":"TotpStatusResponse"},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"},"input":{"title":"Input"},"ctx":{"type":"object","title":"Context"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"},"VoiceInteractionRequest":{"properties":{"provider":{"type":"string","title":"Provider","default":"voice:offline"},"text":{"type":"string","minLength":1,"title":"Text"},"source_receipt":{"type":"string","minLength":1,"title":"Source Receipt"},"profile":{"type":"string","title":"Profile","default":"fast"},"mode":{"type":"string","title":"Mode","default":"normal"},"command":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Command"},"explicit_command":{"type":"boolean","title":"Explicit Command","default":false}},"type":"object","required":["text","source_receipt"],"title":"VoiceInteractionRequest"},"VoiceReadbackRequest":{"properties":{"provider":{"type":"string","title":"Provider","default":"voice:offline"}},"type":"object","title":"VoiceReadbackRequest"},"trivon__admin_api__IntakeRequest":{"properties":{"goal":{"type":"string","title":"Goal","default":""},"requisition_id":{"type":"string","title":"Requisition Id","default":""},"cem":{"additionalProperties":true,"type":"object","title":"Cem"},"signals":{"items":{"additionalProperties":true,"type":"object"},"type":"array","title":"Signals","default":[]},"decision_procedure":{"type":"string","title":"Decision Procedure","default":""},"confusion_semantics":{"additionalProperties":true,"type":"object","title":"Confusion Semantics","default":{}},"evidence_source":{"type":"string","title":"Evidence Source","default":""},"evaluation_timing":{"type":"string","title":"Evaluation Timing","default":"immediate"},"minimum_support":{"type":"integer","title":"Minimum Support","default":0},"class_balance_metric":{"type":"string","title":"Class Balance Metric","default":""},"sampling_plan":{"type":"string","title":"Sampling Plan","default":""},"cost_weighting":{"additionalProperties":true,"type":"object","title":"Cost Weighting","default":{}},"abstention_treatment":{"type":"string","title":"Abstention Treatment","default":""},"dispute_procedure":{"type":"string","title":"Dispute Procedure","default":""},"authority":{"additionalProperties":true,"type":"object","title":"Authority","default":{}},"is_proxy":{"type":"boolean","title":"Is Proxy","default":false},"proxy_blindspot":{"title":"Proxy Blindspot"},"proxy_acceptance":{"title":"Proxy Acceptance"}},"type":"object","required":["cem"],"title":"IntakeRequest","description":"Run the INTAKE rule-extraction funnel (PRODUCT_STAGE_MODEL_v2 Stage 0): turn a fuzzy goal\n+ the descent's structured result into an EARNED CEM (rule passes §2), an ATTESTED CEM (no\ncheckable rule), or NEVER-AUTONOMOUS (World-1). Every field is TENANT data (Law 1 — the funnel\nhardcodes no domain list): `cem` is the 11-field CEM skeleton (its declared world lives here);\n`signals` are the candidate observations (a signal survives iff `data_field` is observable);\nthe rest is the tenant's measurement + authority plan for the extracted success rule."},"trivon__adviser__IntakeRequest":{"properties":{"source":{"type":"string","title":"Source"},"title":{"type":"string","title":"Title"},"content":{"type":"string","title":"Content"},"file_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"File Name"}},"type":"object","required":["source","title","content"],"title":"IntakeRequest"},"trivon__capture_approve__DispositionRequest":{"properties":{"candidate_id":{"type":"string","title":"Candidate Id"},"reason":{"type":"string","title":"Reason","default":""}},"type":"object","required":["candidate_id"],"title":"DispositionRequest"},"trivon__control_api__DispositionRequest":{"properties":{"proposal_ref":{"type":"string","title":"Proposal Ref"},"disposition":{"type":"string","title":"Disposition"},"reason":{"type":"string","title":"Reason","default":""},"evidence_present":{"type":"boolean","title":"Evidence Present","default":false}},"type":"object","required":["proposal_ref","disposition"],"title":"DispositionRequest","description":"A human's approve/reject of ONE shadow-action proposal.\n\nproposal_ref     — the id of the proposal being disposed (the shadow act's record /\n                   idempotency key); it ties the durable disposition + the scoring\n                   observation to the SPECIFIC proposal.\ndisposition      — 'approve' (concurrence) | 'reject' (override).\nreason           — optional free-text provenance (WHY), recorded on the durable row.\nevidence_present — the proposal's record substance (the SAME field the probe uses to describe a\n                   record): False = a violation the agent proposed to FLAG (would_flag=True, so\n                   a reject registers as a real override); True = a complete pack\n                   (would_flag=False). The framework DERIVES would_flag from this + the rule —\n                   the caller states the record, never the verdict."}}}}