Configured Score replay contract

The generated API reference and owner JSON contract describe the four Score operations under /api/v1 with scanner:scoreReplay:enabled=true. The feature defaults to false. An operator can configure another API base; this captured profile does not establish its destination, deployed enablement or live availability. There is no predecessor Score-route alias.

The contract was generated from the actual Scanner Program in a local Testing host, with source ref 7493e56e599c194710aac04793a66715a9f4160a. Its x-stellaops-capture extension records the resolved API base and feature flag plus the raw host-document, host-assembly and capture-test-assembly digests. Those producer facts remain distinct from later source-review commits. The test host and its test authentication do not qualify a real issuer, JWKS, installation or operator journey.

Metadata capture uses the existing authority-disabled Testing profile; permission enforcement is qualified separately with Authority enabled.

Four owner-host cases check default-off, explicit-off, enabled default-base and enabled custom-base behavior, including operation names, read policies and additional write/audit metadata. Four separate authorization cases retain the actual enabled-Authority Scanner policies while supplying local test principals; denied requests do not reach the provider, and permitted requests retain their actual missing-data or provider-refusal responses. The neighboring Scanner cases also check stored-proof fixtures, the unchanged production scorer’s refusal of unavailable measurements, bundle ownership and tenant isolation. The 43 Scanner cases and 82 CLI consumer cases are local native evidence; focused subsets are not added a second time.

The older eight-path expected fixture is a bounded contract-test asset. It omits Score operations and is neither a full host inventory nor the enabled Score authority. Its absence of Score paths does not show that the enabled routes are unavailable. The new capture does not change that fixture or the feature default.

Regenerate the pair offline with:

pwsh tools/scripts/docs/regen-from-openapi.ps1 -Service scanner -Contract score-replay -AggregatePath docs/modules/scanner/openapi/score-replay.v1.json

For a fresh capture, run ScoreReplayOpenApiCaptureTests.EnabledOwnerPublishesFourSourceBoundContracts through the canonical targeted xUnit wrapper, setting STELLAOPS_OPENAPI_EXPORT_PATH to a new absolute repository tmp/ file, STELLAOPS_TEST_REPOSITORY_ROOT to the current worktree, and STELLAOPS_OPENAPI_CAPTURE_SOURCE_REF to its committed source ref. The native host capture, resolved configuration, source equality, binary digests and review-chain inputs must be reviewed together before replacing the published contract. A saved scoped document alone does not prove current host freshness.