S00 Endpoint Contract Ledger v1

Status: Frozen baseline (reconciled with backend implementation) Date: 2026-02-19 Working directory: docs/modules/ui/v2-rewire Template source: S00_contract_ledger_template.md Sprint: 20260218_005, task R0-06

Reconciliation note (2026-02-19)

Frontend shell structure was reverified in SPRINT_20260219_002 to SPRINT_20260219_007.
Backend dependency rows S00-T05-RC-01 and S00-T05-SEC-02 are shipped and reclassified to EXISTS_COMPAT; frontend endpoint consumption for both rows is now implemented in UI surfaces.
Backend contract-enrichment adapters were implemented in SPRINT_20260219_016 for S00-T05-DASH-01, S00-T05-RC-02, S00-T05-RUN-01, S00-T05-APR-01, S00-T05-ENV-01, S00-T05-SEC-01, S00-T05-EVID-01, S00-T05-INT-01, and S00-T05-OPS-01; these rows are now reclassified to EXISTS_COMPAT.
Backend administration adapters now cover Pack-21 A0-A7 (/api/v1/administration/{summary,identity-access,tenant-branding,notifications,usage-limits,policy-governance,trust-signing,system}), so S00-T05-ADM-01 is reclassified to EXISTS_COMPAT.
Trust owner mutation routes for keys/issuers/certificates/transparency log are implemented under /api/v1/administration/trust-signing/* with platform.trust.write / platform.trust.admin, backed by Platform DB migration 046_TrustSigningAdministration.sql.
Readiness reconciliation is recorded in S16_release_readiness_package.md.
Frontend release creation was re-aligned on 2026-03-31: /releases/new is now a split-flow handoff page, /releases/promotions/create is the canonical target/gate/approval flow, and /releases/deployments/new remains only as a compatibility redirect into promotions.

Status class definitions

Status class	Meaning
`EXISTS_COMPAT`	Endpoint exists and is compatible with v2 screen needs without schema change.
`EXISTS_ADAPT`	Endpoint exists but requires schema additions, filter/sort extensions, or composition changes for v2.
`MISSING_NEW`	No endpoint exists; must be designed and implemented before the consuming sprint can complete.

Ledger

Domain	Screen/Page	Canonical source refs	Current route/page	Current endpoint candidate(s)	Status	Owner module	Auth scope impact	Schema delta summary	Decision/risk notes	Action ticket
Dashboard	Dashboard v3 mission board	`source-of-truth.md 3.2`, `authority-matrix.md A: Dashboard`, `pack-16.md`	`/` (control-plane/dashboard variants)	`GET /api/v1/dashboard/summary`; existing promotion, approval, and scan summary endpoints	`EXISTS_COMPAT`	`Web` (composition) + `ReleaseOrchestrator`, `Policy`, `Scanner`	No new scopes; requires existing viewer scopes	Implemented in Platform pack adapters with deterministic data-confidence, CritR env breakdown, B/I/R coverage, and top-driver fields consumed by dashboard v3 cards	Route finalized to `/api/v1/dashboard/summary`; validated by `PackAdapterEndpointsTests`	`S00-T05-DASH-01`
Release Control	Bundle catalog/detail/builder	`source-of-truth.md 3.1`, `authority-matrix.md A: bundles`, `pack-12.md`	`/release-control/bundles/*`	`GET /api/v1/release-control/bundles`; `GET /api/v1/release-control/bundles/{bundleId}`; `GET /api/v1/release-control/bundles/{bundleId}/versions`; `GET /api/v1/release-control/bundles/{bundleId}/versions/{versionId}`; `POST /api/v1/release-control/bundles`; `POST /api/v1/release-control/bundles/{bundleId}/versions`; `POST /api/v1/release-control/bundles/{bundleId}/versions/{versionId}/materialize`	`EXISTS_COMPAT`	`Platform` (`StellaOps.Platform.WebService`)	`orch:read` (read routes), `orch:operate` (create/publish/materialize)	Implemented with Postgres-backed lifecycle tables (`release.control_bundles*`) plus deterministic list ordering and idempotent materialization key handling	Collision with Evidence bundle export routes resolved by dedicated `/api/v1/release-control/*` namespace; frontend bundle surfaces are now API-bound (see sprint `20260219_003` RC3-06)	`S00-T05-RC-01`
Release Control	Promotions list/create/detail	`source-of-truth.md 3.1`, `authority-matrix.md A: releases`, `pack-13.md`	`/releases/promotions/*`	`GET /api/release-jobengine/approvals` (list); `GET /api/release-jobengine/approvals/{id}` (detail); `GET /api/release-jobengine/releases/{releaseId}/available-environments` (target preflight); `GET /api/release-jobengine/releases/{releaseId}/promotion-preview` (gate preflight); `POST /api/release-jobengine/releases/{releaseId}/promote` (create); `POST /api/release-jobengine/approvals/{id}/approve`; `POST /api/release-jobengine/approvals/{id}/reject`	`EXISTS_COMPAT`	`ReleaseOrchestrator`	Existing `orch:read` / `orch:operate`	Legacy promotion/approval payloads are enriched with manifest digest, risk snapshot, hybrid reachability coverage, ops confidence, and decision digest via `ApprovalEndpoints.WithDerivedSignals`	Contract fields verified by `ReleaseControlV2EndpointsTests`; `/releases/new` now hands users into this surface and `/releases/deployments/new` is retained only as a compatibility redirect. Bundle/version/hotfix context may be preserved on the handoff page, but the FE no longer aliases those identities into the promotion API’s `releaseId` parameter.	`S00-T05-RC-02`
Release Control	Run timeline, checkpoints, rollback	`source-of-truth.md 3.1`, `authority-matrix.md A: run timeline`, `pack-14.md`	`/deployments/*` and run views	`GET /api/v1/runs/{id}` (run detail); `GET /api/v1/runs/{id}/steps` (step list); `GET /api/v1/runs/{id}/steps/{stepId}` (step detail + logs); `POST /api/v1/runs/{id}/rollback` (trigger rollback)	`EXISTS_COMPAT`	`ReleaseOrchestrator`	Existing `orch:read` / `orch:operate`	Implemented v2 run contracts include ordered checkpoints plus explicit evidence-thread and log-artifact links; rollback returns deterministic accepted payload with guard state	`/api/v1/runs/` and `/v1/runs/` compatibility routes are live and test-backed; policy-coupled rollback guard hardening remains future work	`S00-T05-RUN-01`
Approvals	Approvals v2 tabs and decision packet	`source-of-truth.md 3.3`, `authority-matrix.md A: approvals`, `pack-17.md`	`/approvals/*`	`GET /api/v1/approvals` (queue); `GET /api/v1/approvals/{id}` (detail); `GET /api/v1/approvals/{id}/gates` (gate trace); `GET /api/v1/approvals/{id}/evidence` (evidence packet); `GET /api/v1/approvals/{id}/security-snapshot` (security tab data); `GET /api/v1/approvals/{id}/ops-health` (ops/data tab); `POST /api/v1/approvals/{id}/decision` (approve/reject/defer/escalate)	`EXISTS_COMPAT`	`Policy` + `ReleaseOrchestrator`	Existing policy reviewer / approver scopes	v2 approvals adapter routes now return deterministic decision-packet shapes containing digest, gate trace, security snapshot (risk + B/I/R), and ops/data confidence payloads	Deterministic ordering and contract fields are verified in `ReleaseControlV2EndpointsTests` (queue determinism, gate ordering, decision mutation, not-found behavior)	`S00-T05-APR-01`
Environment	Environment detail standard tabs	`source-of-truth.md 3.1 and 3.6`, `authority-matrix.md A: env detail`, `pack-18.md`	`/environments/*`	`GET /api/v1/environments/{id}` (detail); `GET /api/v1/environments/{id}/deployments` (deployment history); `GET /api/v1/environments/{id}/security-snapshot` (security state); `GET /api/v1/environments/{id}/evidence` (evidence summary); `GET /api/v1/environments/{id}/ops-health` (data confidence)	`EXISTS_COMPAT`	`ReleaseOrchestrator`	Existing `orch:read`	Pack-18 environment tab contracts are implemented with standardized header fields (manifest digest, risk snapshot, B/I/R coverage, ops confidence) and deterministic deployment ordering	Environment adapters are live under `/api/v1/environments/*` and validated in `ReleaseControlV2EndpointsTests`	`S00-T05-ENV-01`
Security and Risk	Risk overview, findings, vulns, vex, exceptions, reachability	`source-of-truth.md 3.4`, `authority-matrix.md A: security`, `pack-19.md`	`/security/*`	`GET /api/v1/security/findings` (decision-first grouped); `GET /api/v1/security/vulnerabilities`; `GET /api/v1/security/vex`; `GET /api/v1/security/reachability`; existing risk/scanner endpoints	`EXISTS_COMPAT`	`Scanner`	Existing security viewer scopes	Security adapter routes now normalize findings/vulnerability/VEX/reachability payloads with deterministic filters and B/I/R confidence fields expected by Pack 19 decision-centric screens	Scanner routes are validated in `SecurityAdapterEndpointsTests`; exception lifecycle remains served by Policy endpoints (`/api/policy/exceptions`) and linked from security flows	`S00-T05-SEC-01`
Security and Risk	Advisory Sources	`source-of-truth.md 3.4 and 5`, `authority-matrix.md B: legacy security data split`, `pack-21.md`, `S00_advisory_sources_spec.md`	`/security-risk/advisory-sources`	`GET /api/v1/advisory-sources`; `GET /api/v1/advisory-sources/summary`; `GET /api/v1/advisory-sources/{id}/freshness` (Concelier); `GET /api/v1/advisory-sources/{id}/impact`; `GET /api/v1/advisory-sources/{id}/conflicts` (Policy)	`EXISTS_COMPAT`	`Concelier` (freshness) + `Policy` (impact/conflicts)	`advisory:read` (Concelier freshness routes), `findings:read` (Policy impact/conflicts routes); tenant header required	Implemented with Concelier freshness + signature-stat projections (`vuln.source_freshness_sla`, `vuln.advisory_source_signature_projection`) and Policy impact/conflict projections (`policy.advisory_source_impacts`, `policy.advisory_source_conflicts`)	Ownership split implemented at endpoint boundary; UI composes read-only facts from Concelier + Policy without write side-effects, including backend advisory stats in detail diagnostics (see sprint `20260219_004` SR4-07)	`S00-T05-SEC-02`
Evidence and Audit	Evidence home, packs, bundles, export, proof, replay, audit	`source-of-truth.md 3.5`, `authority-matrix.md A: evidence`, `pack-20.md`	`/evidence/*`	`GET /api/v1/evidence` (home); `GET /api/v1/evidence/packs` (pack list); `GET /api/v1/evidence/packs/{id}` (pack detail); `GET /api/v1/evidence/proofs/{subjectDigest}` (proof chain); `GET /api/v1/evidence/thread/{id}` (evidence thread); `GET /api/v1/evidence/audit` (unified audit log); `GET /api/v1/evidence/receipts/cvss/{id}`	`EXISTS_COMPAT`	`EvidenceLocker` + `Attestor`	Existing evidence viewer scopes	Evidence adapter family is implemented for home/packs/proofs/audit/receipts plus thread lookup with deterministic ordering and explicit not-found contracts	Routes are validated by `EvidenceAuditEndpointsTests`; trust management remains an Administration owner workflow while evidence APIs stay read-only consumer surfaces	`S00-T05-EVID-01`
Administration	A0 overview + A1 Identity and Access + A2 Tenant and Branding + A3 Notifications + A4 Usage and Limits + A5 Policy Governance + A6 Trust and Signing + A7 System	`source-of-truth.md 2.2 and 3.8`, `authority-matrix.md A: administration`, `pack-21.md`	`/settings/` migration targets and new `/administration/` routes	`GET /api/v1/administration/summary`; `GET /api/v1/administration/identity-access`; `GET /api/v1/administration/tenant-branding`; `GET /api/v1/administration/notifications`; `GET /api/v1/administration/usage-limits`; `GET /api/v1/administration/policy-governance`; `GET /api/v1/administration/trust-signing`; `GET /api/v1/administration/system`; `GET /api/v1/administration/trust-signing/{keys,issuers,certificates,transparency-log}`; `POST /api/v1/administration/trust-signing/keys`; `POST /api/v1/administration/trust-signing/keys/{keyId}/rotate`; `POST /api/v1/administration/trust-signing/keys/{keyId}/revoke`; `POST /api/v1/administration/trust-signing/issuers`; `POST /api/v1/administration/trust-signing/certificates`; `POST /api/v1/administration/trust-signing/certificates/{certificateId}/revoke`; `PUT /api/v1/administration/trust-signing/transparency-log`	`EXISTS_COMPAT`	`Platform` (composition) + `Authority` + `Policy`	`platform.setup.read` for A0/A1/A2/A3/A4/A5/A7 adapters; A6 read routes use `platform.trust.read` (`trust:read`), owner mutations use `platform.trust.write` (`trust:write`) and `platform.trust.admin` (`trust:admin`)	Pack adapters now return deterministic A1-A7 payloads plus `legacyAliases` route-migration metadata for `/settings/`, `/policy/`, and `/admin/*`; trust-owner mutation routes persist deterministic state via Platform stores	Adapter surface decouples frontend from legacy prefixes while preserving explicit trust-owner boundaries and admin-grade mutation authorization for keys/issuers/certificates/transparency configuration	`S00-T05-ADM-01`
Integrations	Integrations taxonomy, hub overview, connector detail, feeds tie-in	`source-of-truth.md 3.7`, `authority-matrix.md A: integrations`, `pack-21.md`, `pack-10.md`	`/settings/integrations/` and `/integrations/` (partially)	`GET /api/v1/integrations` (hub list); `GET /api/v1/integrations/{id}` (connector detail); `GET /api/v1/integrations/{id}/health` (health check); `GET /api/v1/integrations/{id}/impact` (impact map); `POST /api/v1/integrations/{id}/test` (test connection)	`EXISTS_COMPAT`	`Integrations`	Existing integration admin scopes	Impact map contract is implemented at `/api/v1/integrations/{id}/impact` with deterministic workflow ordering; list/detail/health/test routes remain compatible for pack-21 integration detail tabs	Endpoint behavior is validated in `IntegrationImpactEndpointsTests`; advisory source ownership split remains handled by `S00-T05-SEC-02`	`S00-T05-INT-01`
Platform Ops	Data Integrity overview + nightly report + feeds freshness + scan pipeline health + reachability ingest + DLQ + data quality SLOs	`source-of-truth.md 3.6`, `authority-matrix.md A: ops`, `pack-15.md`, `pack-10.md`, `pack-21.md`	`/operations/*` (current)	`GET /api/v1/platform/data-integrity/summary` (overview cards); `GET /api/v1/platform/data-integrity/report` (nightly report); `GET /api/v1/platform/feeds/freshness` (feeds health); `GET /api/v1/platform/scan-pipeline/health`; `GET /api/v1/platform/reachability/ingest-health`; existing DLQ and SLO endpoints	`EXISTS_COMPAT`	`Orchestrator` + `Concelier` + `Scanner`	Existing ops viewer scopes	Platform pack adapters now expose the data-integrity aggregate routes required by Packs 15/21 with deterministic card/report ordering and feed/pipeline/reachability drilldown links	Endpoints and tenant-header validation are covered in `PackAdapterEndpointsTests`; ownership split with Integrations remains explicit per `S00_advisory_sources_spec.md`	`S00-T05-OPS-01`

Sign-off requirement

Before readiness closure, frontend and backend leads must confirm:

All previously MISSING_NEW rows are either shipped or formally deferred with owner/date.
Any EXISTS_ADAPT rows (none at this revision) have backend team acknowledgment of planned schema delta.
No active-authority screen remains unclassified.

Sign-off is captured in S00_handoff_packet.md.