{
  "id": "basekey.workflow.generated-proxy",
  "classification": "public-authenticated-same-origin-proxy",
  "route_file": "src/routes/api/$.tsx",
  "start_owned_operation_routes": [
    {
      "operation_id": "workflowV1DraftGet",
      "path": "/api/v1/workflows/draft",
      "method": "GET",
      "route_file": "src/routes/api/v1/workflows_.draft.tsx",
      "runtime_file": "src/server/workflow-api/operation-handlers.ts",
      "classification": "private",
      "canonical": true,
      "deprecated": true,
      "deprecated_by": "/api/workflow/draft",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/operation-handlers.ts#handleDraftGet",
      "authoritative_writer": "none; read-only compatibility identity"
    },
    {
      "operation_id": "workflowInternalCredentialGet",
      "path": "/api/internal/credentials/{credentialId}",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "internal",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/credential-handlers.ts",
      "authoritative_writer": "basekey-frontend/src/app/api/credentials/direct-driver.ts#getDirectCredentialMaterial",
      "forbidden_fallbacks": [
        "legacy rcm-frontend credential proxy",
        "web-agent direct SSM fallback after Start internal credential material read failure",
        "local synthetic credential material",
        "request/read repair of missing direct credential parameters"
      ],
      "freshness_tuple": {
        "concept": "basekey_workflow_credential_status_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowInternalCredentialGet + direct SSM credential parameters",
        "authoritative_writer": "basekey-frontend/src/app/api/credentials/direct-driver.ts#getDirectCredentialMaterial",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound/no-store",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowCapacitySummaryGet",
      "path": "/api/workflow/capacity-summary",
      "method": "GET",
      "route_file": "src/routes/api/workflow/capacity-summary.tsx",
      "classification": "private",
      "canonical_owner": "rcm-orchestrator BrowserRuntimeReservation warm-pool-status projection",
      "authoritative_writer": "get_warm_pool_status_api_v2_container_assignment_warm_pool_status_get",
      "forbidden_fallbacks": [
        "legacy active-sessions API for capacity totals",
        "frontend-origin capacity synthesis when CRD authority is missing",
        "same-process Next.js route imports",
        "request/read repair of CRD authority fields"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_capacity_read_model",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowCapacitySummaryGet + ../rcm-orchestrator/contracts/api/orchestrator.public.openapi.json#operationId=get_warm_pool_status_api_v2_container_assignment_warm_pool_status_get",
        "authoritative_writer": "workflow.openapi.workflowCapacitySummaryGet + rcm-orchestrator warm-pool-status",
        "key_version_hash": "workflow=e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe;orchestrator=e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime read in useWorkflowCapacitySummary",
        "expiry_ttl": "PT15S from CRD authority",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowDataHubBindingMappingSuggestionsPost",
      "path": "/api/v1/workflows/{workflowId}/data-hub-binding/mapping-suggestions",
      "method": "POST",
      "route_file": "src/routes/api/$.tsx",
      "runtime_file": "src/server/workflow-api/data-hub-mapping-suggestions-handler.ts",
      "classification": "private",
      "canonical": true,
      "canonical_owner": "basekey-frontend/src/server/workflow-api/data-hub-mapping-suggestions.ts#readWorkflowDataHubMappingSuggestions",
      "authoritative_writer": "none; read-only mapping suggestions"
    },
    {
      "operation_id": "workflowV1CreatePost",
      "path": "/api/v1/workflows",
      "method": "POST",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#user_workflow",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic workflow replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowV1CreatePost + shared Postgres user_workflow",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowV1ListGet",
      "path": "/api/v1/workflows",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#user_workflow",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic workflow replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowV1ListGet + shared Postgres user_workflow",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowDraftGet",
      "path": "/api/workflow/draft",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#user_workflow.draft_state",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic draft replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowDraftGet + shared Postgres user_workflow.draft_state",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowDraftPut",
      "path": "/api/workflow/draft",
      "method": "PUT",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#user_workflow.draft_state",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic draft replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowDraftPut + shared Postgres user_workflow.draft_state",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowByIdGet",
      "path": "/api/workflow/{workflowId}",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#user_workflow",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic workflow replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowByIdGet + shared Postgres user_workflow",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowGraphGet",
      "path": "/api/workflow/graph",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#user_workflow.draft_state",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic graph replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowGraphGet + shared Postgres user_workflow.draft_state",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowRunsGet",
      "path": "/api/workflow-runs",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#workflow_execution",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic run replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsGet + shared Postgres workflow_execution",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      },
      "runtime_status_projection": {
        "concept": "basekey_workflow_run_runtime_status_projection",
        "owner": "basekey-frontend/src/server/workflow-api",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsGet|workflowRunsActiveGet|workflowRunByIdGet + shared Postgres workflow_execution.results.metadata",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts",
        "allowed_writers": [
          "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts"
        ],
        "allowed_readers": [
          "basekey-frontend/src/server/workflow-api/operation-handler-utils.ts",
          "generated workflow client callers for workflowRunsGet",
          "generated workflow client callers for workflowRunsActiveGet",
          "generated workflow client callers for workflowRunByIdGet"
        ],
        "forbidden_fallbacks": [
          "fallback runtime-status endpoints",
          "local synthesized runtime success",
          "metadata.runtime_status read repair",
          "request-time workflow_execution mutation",
          "duplicate route writer outside the generated Start workflow API runtime",
          "UI success claims from this projection lane"
        ],
        "freshness_tuple": {
          "concept": "basekey_workflow_run_runtime_status_projection",
          "owner": "basekey-frontend",
          "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsGet|workflowRunsActiveGet|workflowRunByIdGet + shared Postgres workflow_execution.results.metadata",
          "authoritative_writer": "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts",
          "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
          "observed_at": "runtime request observedAt",
          "expiry_ttl": "request-bound; runtime lease expires_at when present",
          "proof_manifest": "task attachment proof_manifest.json"
        }
      }
    },
    {
      "operation_id": "workflowRunsActiveGet",
      "path": "/api/workflow-runs/active",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#workflow_execution",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic run replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsActiveGet + shared Postgres workflow_execution",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      },
      "runtime_status_projection": {
        "concept": "basekey_workflow_run_runtime_status_projection",
        "owner": "basekey-frontend/src/server/workflow-api",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsGet|workflowRunsActiveGet|workflowRunByIdGet + shared Postgres workflow_execution.results.metadata",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts",
        "allowed_writers": [
          "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts"
        ],
        "allowed_readers": [
          "basekey-frontend/src/server/workflow-api/operation-handler-utils.ts",
          "generated workflow client callers for workflowRunsGet",
          "generated workflow client callers for workflowRunsActiveGet",
          "generated workflow client callers for workflowRunByIdGet"
        ],
        "forbidden_fallbacks": [
          "fallback runtime-status endpoints",
          "local synthesized runtime success",
          "metadata.runtime_status read repair",
          "request-time workflow_execution mutation",
          "duplicate route writer outside the generated Start workflow API runtime",
          "UI success claims from this projection lane"
        ],
        "freshness_tuple": {
          "concept": "basekey_workflow_run_runtime_status_projection",
          "owner": "basekey-frontend",
          "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsGet|workflowRunsActiveGet|workflowRunByIdGet + shared Postgres workflow_execution.results.metadata",
          "authoritative_writer": "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts",
          "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
          "observed_at": "runtime request observedAt",
          "expiry_ttl": "request-bound; runtime lease expires_at when present",
          "proof_manifest": "task attachment proof_manifest.json"
        }
      }
    },
    {
      "operation_id": "workflowRunByIdGet",
      "path": "/api/workflow-runs/{runId}",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#workflow_execution",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic run replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunByIdGet + shared Postgres workflow_execution",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      },
      "runtime_status_projection": {
        "concept": "basekey_workflow_run_runtime_status_projection",
        "owner": "basekey-frontend/src/server/workflow-api",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsGet|workflowRunsActiveGet|workflowRunByIdGet + shared Postgres workflow_execution.results.metadata",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts",
        "allowed_writers": [
          "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts"
        ],
        "allowed_readers": [
          "basekey-frontend/src/server/workflow-api/operation-handler-utils.ts",
          "generated workflow client callers for workflowRunsGet",
          "generated workflow client callers for workflowRunsActiveGet",
          "generated workflow client callers for workflowRunByIdGet"
        ],
        "forbidden_fallbacks": [
          "fallback runtime-status endpoints",
          "local synthesized runtime success",
          "metadata.runtime_status read repair",
          "request-time workflow_execution mutation",
          "duplicate route writer outside the generated Start workflow API runtime",
          "UI success claims from this projection lane"
        ],
        "freshness_tuple": {
          "concept": "basekey_workflow_run_runtime_status_projection",
          "owner": "basekey-frontend",
          "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsGet|workflowRunsActiveGet|workflowRunByIdGet + shared Postgres workflow_execution.results.metadata",
          "authoritative_writer": "basekey-frontend/src/server/workflow-api/runtime-status-projection.ts",
          "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
          "observed_at": "runtime request observedAt",
          "expiry_ttl": "request-bound; runtime lease expires_at when present",
          "proof_manifest": "task attachment proof_manifest.json"
        }
      }
    },
    {
      "operation_id": "workflowRunByIdDelete",
      "path": "/api/workflow-runs/{runId}",
      "method": "DELETE",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#workflow_execution.status/completed_at/results.metadata",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "direct DB or Redis cleanup shell",
        "physical workflow_execution row deletion",
        "local synthetic run replacement"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_run_terminalization_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunByIdDelete + shared Postgres workflow_execution",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#deleteRun",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowRunCacheReplayRefsGet",
      "path": "/api/workflow-runs/{runId}/cache-replay-refs",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/runtime.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts#workflow_execution.results",
      "forbidden_fallbacks": [
        "legacy rcm-frontend proxy",
        "same-process Next route import",
        "request/read repair",
        "local synthetic cache replay refs"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_api_seed_readback_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunCacheReplayRefsGet + shared Postgres workflow_execution.results",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/repository.ts",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowRunStartAdmissionGet",
      "path": "/api/workflow/{workflowId}/run-start-admission",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/run-start-admission-handler.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/run-start-admission-handler.ts#handleRunStartAdmissionGet",
      "forbidden_fallbacks": [
        "frontend XState or React controller resolving workflow run-start collision policy",
        "component-local browser-session routing fallback as workflow admission",
        "read repair of missing run-start routing",
        "same-process API hop around the generated workflow operation",
        "local synthetic replacement run-start admission data",
        "blocking workflow admission on Browser/WebRTC/cache readiness for workflows without a Browser node"
      ],
      "freshness_tuple": {
        "concept": "basekey_workflow_editor_run_start_admission",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunStartAdmissionGet + shared Postgres user_workflow/workflow_execution + runtime capability plan",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/run-start-admission-handler.ts#handleRunStartAdmissionGet",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowPreflightPost",
      "path": "/api/workflow/{workflowId}/preflight",
      "method": "POST",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/preflight.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/preflight.ts#handleWorkflowPreflightPost",
      "forbidden_fallbacks": [
        "transient Test Run values in workflowPreflightPost",
        "synthetic Data Hub binding context for runtime inputs",
        "request/read repair of missing workflow input mappings",
        "same-process API hop around the generated workflow operation"
      ],
      "freshness_tuple": {
        "concept": "basekey_workflow_input_binding_readiness",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowPreflightPost + shared Postgres user_workflow.draft_state.variableGraph",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/preflight.ts#handleWorkflowPreflightPost",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound/no-store",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowRunsStartPost",
      "path": "/api/workflow/runs/start",
      "method": "POST",
      "route_file": "src/routes/api/workflow/runs/start.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-run-start/control-plane-authority.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-run-start/start-db-admission-writer.ts#reserveWorkflowRunTransaction",
      "forbidden_fallbacks": [
        "duplicate workflow run-start endpoint or writer",
        "caller-supplied Browser Runtime routing authority",
        "persisted or logged transient Test Run secrets",
        "Temporal or provider dispatch with missing required runtime row_data",
        "request/read repair of stale run-start admission"
      ],
      "freshness_tuple": {
        "concept": "basekey_start_workflow_run_required_runtime_input_authority",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunsStartPost + canonical workflow draft + request-bound row_data",
        "authoritative_writer": "basekey-frontend/src/server/workflow-run-start/start-db-admission-writer.ts#reserveWorkflowRunTransaction",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound/process-memory-only",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowEditorContractGet",
      "path": "/api/workflow/editor-contract",
      "method": "GET",
      "route_file": "src/routes/api/workflow/editor-contract.tsx",
      "runtime_file": "src/server/workflow-api/editor-contract-handler.ts",
      "classification": "public",
      "canonical": true,
      "canonical_owner": "src/contracts/workflow/editor-contract-v1.ts#buildEditorContractV1Response",
      "authoritative_writer": "scripts/contracts/generate-editor-contract.mjs"
    }
  ],
  "allowed_methods": [
    "GET",
    "POST",
    "PUT",
    "PATCH",
    "DELETE"
  ],
  "allowed_endpoint_authority": {
    "artifact": "docs/openapi/workflow-v1.generated.json",
    "artifact_sha256": "5760e2283b0d028b6c4657d8261b7b85e8585ae3751a6d69973861ed10f4fd75",
    "generated_operation_table": "src/generated/workflow-client/operation-definitions.ts",
    "generated_path_parameter_schemas": "src/generated/workflow-client/path-parameter-schemas.ts"
  },
  "composed_endpoint_authorities": [
    {
      "id": "basekey.web-agent-session-runtime.generated-proxy",
      "artifact": "docs/openapi/web-agent-session-runtime-consumer.openapi.json",
      "artifact_sha256": "87181db35b57167a40e6b20f1097cd11ad6d30b6805c146b5418fd3809cd6b41",
      "generated_operation_table": "src/generated/web-agent-session-runtime-client/index.ts",
      "manifest": "docs/openapi/basekey-web-agent-session-runtime-proxy.manifest.json",
      "source_artifacts": [
        "../rcm-web-agent/contracts/api/web-agent.public.openapi.json",
        "../rcm-web-agent/contracts/api/web-agent.private.openapi.json"
      ],
      "operation_authority_sha256": "b9f163df2bef1bd48496a830062090e8a5b615c1b5cc84bc8bba0067178964c4"
    },
    {
      "id": "basekey.web-agent-task-status.generated-proxy",
      "operation_id": "taskStatusGet",
      "path": "/api/v2/task-status/{task_id}",
      "public_proxy_path": "/api/web-agent/task-status/{task_id}",
      "upstream_path": "/api/v2/task-status/{task_id}",
      "method": "GET",
      "classification": "public",
      "proxy_classification": "public-authenticated-same-origin-proxy",
      "canonical_owner": "rcm-web-agent task-status API",
      "authoritative_record": "../rcm-web-agent/contracts/api/web-agent-task-status.openapi.json#operationId=taskStatusGet",
      "authoritative_writer": "scripts/contracts/generate-web-agent-task-status-client.mjs",
      "artifact": "../rcm-web-agent/contracts/api/web-agent-task-status.openapi.json",
      "artifact_sha256": "a19462a71954f7f7720210fa870791de49d4848f5957d54b2268dae928760ca6",
      "generated_operation_table": "src/generated/web-agent-task-status-client/index.ts",
      "forbidden_fallbacks": [
        "handwritten /api/v2/task-status route strings",
        "legacy /api/workflow-tasks status path as terminal authority",
        "same-process task-status service imports",
        "synthetic terminal rows or cache refs",
        "read repair when generated taskStatusGet is unavailable"
      ],
      "freshness_tuple": {
        "concept": "basekey_web_agent_task_status_generated_proxy",
        "owner": "basekey-frontend",
        "authoritative_record": "../rcm-web-agent/contracts/api/web-agent-task-status.openapi.json#operationId=taskStatusGet",
        "authoritative_writer": "scripts/contracts/generate-web-agent-task-status-client.mjs",
        "key_version_hash": "a19462a71954f7f7720210fa870791de49d4848f5957d54b2268dae928760ca6",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    }
  ],
  "runtime_guard": {
    "module": "src/lib/api/workflow-proxy-runtime.ts",
    "matcher": "findGeneratedProxyOperation",
    "failure_code": "BASEKEY_WORKFLOW_PROXY_OPERATION_NOT_DECLARED"
  },
  "contract_authority": {
    "response_authority_source": "src/lib/api/workflow-proxy-generated-operations.ts#generatedProxyResponseHeaderPolicy",
    "workflow_operation_id_header": "X-Basekey-Workflow-Proxy-Operation-Id",
    "workflow_openapi_sha256_header": "X-Basekey-Workflow-Proxy-Openapi-Sha256",
    "workflow_assistant_operation_contract_sha256_header": "X-Basekey-Workflow-Assistant-Operation-Contract-Sha256",
    "workflow_assistant_hash_precedence": "An operation-contract hash takes precedence when present; otherwise compatibility uses the document hash.",
    "remote_start_expected_request_headers": {
      "all_forwarded_generated_operations": "X-Basekey-Expected-Openapi-Sha256",
      "workflow_assistant_operations_also": "X-Basekey-Expected-Operation-Contract-Sha256"
    },
    "expected_hash_authority": "The forwarding Start replaces caller values with the same recorded authority hashes used for response validation, on the operation request without an extra call.",
    "receiving_start_guard": "Generic proxy dispatch and native withServerRoutePermissions share one guard before authentication, permission admission and handler execution.",
    "mismatch_status": 412,
    "mismatch_code": "BASEKEY_GENERATED_CONTRACT_PRECONDITION_FAILED",
    "absent_precondition_headers": "When both expected-contract headers are absent, existing admission is unchanged.",
    "runtime_upstream_forwarding": "Expected-contract headers are Start-to-Start preconditions and are removed before forwarding to runtime upstreams.",
    "older_start_compatibility": "Older deployed Start versions ignore request preconditions. Preserve the post-response authority validator and its existing 502 on missing or mismatched authority; it cannot prevent an older upstream's side effects."
  },
  "forwarding_policy": {
    "origin_env": [
      "BASEKEY_API_ORIGIN",
      "API_URL",
      "APP_BASE_URL"
    ],
    "drops_request_headers": [
      "cookie",
      "host",
      "content-length",
      "connection"
    ],
    "drops_response_headers": [
      "set-cookie",
      "content-length",
      "content-encoding",
      "connection"
    ],
    "auth_authority": "canonical auth headers from /auth/session readback, forwarded by generated workflow client callers"
  },
  "owned_consumers": [
    "src/hooks/useWorkflowDashboard.ts",
    "src/hooks/useWorkflowCapacitySummary.ts",
    "src/components/workflow/WorkflowRunsList.tsx",
    "src/components/workflow/editor/useWorkflowEditorChromeReadModel.ts",
    "src/components/workflow/editor/useWorkflowEditorDiagramReadModel.ts",
    "src/services/run-telemetry.ts",
    "src/app/api/workflow-tasks/utils.ts",
    "scripts/dev/test-catalog/rcm-sb-browser-cache-replay-smoke-runner.mjs"
  ],
  "owned_operation_consumers": [
    {
      "operation_id": "workflowCapacitySummaryGet",
      "path": "/api/workflow/capacity-summary",
      "method": "GET",
      "classification": "private",
      "canonical_owner": "rcm-orchestrator BrowserRuntimeReservation warm-pool-status projection",
      "authoritative_writer": "get_warm_pool_status_api_v2_container_assignment_warm_pool_status_get",
      "consumer": "src/hooks/useWorkflowCapacitySummary.ts",
      "freshness_tuple": {
        "concept": "basekey_start_workflow_capacity_read_model",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowCapacitySummaryGet + ../rcm-orchestrator/contracts/api/orchestrator.public.openapi.json#operationId=get_warm_pool_status_api_v2_container_assignment_warm_pool_status_get",
        "authoritative_writer": "workflow.openapi.workflowCapacitySummaryGet + rcm-orchestrator warm-pool-status",
        "key_version_hash": "workflow=e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe;orchestrator=e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime read in useWorkflowCapacitySummary",
        "expiry_ttl": "PT15S from CRD authority",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowByIdGet",
      "path": "/api/workflow/{workflowId}",
      "method": "GET",
      "classification": "private",
      "canonical_owner": "workflow",
      "authoritative_writer": "workflow.openapi.workflowByIdGet",
      "consumer": "src/components/workflow/editor/useWorkflowEditorDiagramReadModel.ts#normalizeWorkflowGraphResponse -> src/components/workflow/editor/useWorkflowEditorChromeReadModel.ts#normalizeWorkflowEditorChromeResponse",
      "freshness_tuple": {
        "concept": "basekey_workflow_editor_chrome",
        "owner": "workflow",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowByIdGet",
        "authoritative_writer": "workflow.openapi.workflowByIdGet",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime read in WorkflowEditorDiagramReadModel; projected into WorkflowEditorHeader",
        "expiry_ttl": "refetch-on-workflow-or-session-change",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowByIdGet",
      "path": "/api/workflow/{workflowId}",
      "method": "GET",
      "classification": "private",
      "canonical_owner": "workflow",
      "authoritative_writer": "workflow.openapi.workflowByIdGet",
      "consumer": "src/components/workflow/editor/useWorkflowEditorDiagramReadModel.ts",
      "freshness_tuple": {
        "concept": "basekey_workflow_runtime_environment_projection",
        "owner": "workflow",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowByIdGet#metadata.workflowConfig.global.environment",
        "authoritative_writer": "workflow.openapi.workflowByIdGet",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime read in WorkflowEditorDiagramSurface",
        "expiry_ttl": "refetch-on-workflow-or-session-change",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowGraphGet",
      "path": "/api/workflow/graph",
      "method": "GET",
      "classification": "private",
      "canonical_owner": "workflow",
      "authoritative_writer": "workflow.openapi.workflowGraphGet",
      "consumer": "src/components/workflow/editor/useWorkflowEditorDiagramReadModel.ts",
      "freshness_tuple": {
        "concept": "basekey_workflow_graph_projection",
        "owner": "workflow",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowGraphGet",
        "authoritative_writer": "workflow.openapi.workflowGraphGet",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime read in WorkflowEditorDiagramSurface",
        "expiry_ttl": "refetch-on-workflow-or-session-change",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "taskStatusGet",
      "path": "/api/v2/task-status/{task_id}",
      "public_proxy_path": "/api/web-agent/task-status/{task_id}",
      "upstream_path": "/api/v2/task-status/{task_id}",
      "method": "GET",
      "classification": "public",
      "proxy_classification": "public-authenticated-same-origin-proxy",
      "canonical_owner": "rcm-web-agent task-status API",
      "authoritative_writer": "taskStatusGet from ../rcm-web-agent/contracts/api/web-agent-task-status.openapi.json",
      "consumer": "src/services/run-telemetry.ts and scripts/dev/test-catalog/rcm-sb-browser-cache-replay-smoke-runner.mjs",
      "freshness_tuple": {
        "concept": "basekey_web_agent_task_status_generated_proxy",
        "owner": "basekey-frontend",
        "authoritative_record": "../rcm-web-agent/contracts/api/web-agent-task-status.openapi.json#operationId=taskStatusGet",
        "authoritative_writer": "scripts/contracts/generate-web-agent-task-status-client.mjs",
        "key_version_hash": "a19462a71954f7f7720210fa870791de49d4848f5957d54b2268dae928760ca6",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      }
    },
    {
      "operation_id": "workflowRunStartAdmissionGet",
      "path": "/api/workflow/{workflowId}/run-start-admission",
      "method": "GET",
      "route_file": "src/routes/api/$.tsx",
      "classification": "private",
      "canonical_owner": "basekey-frontend/src/server/workflow-api/run-start-admission-handler.ts",
      "authoritative_writer": "basekey-frontend/src/server/workflow-api/run-start-admission-handler.ts#handleRunStartAdmissionGet",
      "forbidden_fallbacks": [
        "frontend XState or React controller resolving workflow run-start collision policy",
        "component-local browser-session routing fallback as workflow admission",
        "read repair of missing run-start routing",
        "same-process API hop around the generated workflow operation",
        "local synthetic replacement run-start admission data",
        "blocking workflow admission on Browser/WebRTC/cache readiness for workflows without a Browser node"
      ],
      "freshness_tuple": {
        "concept": "basekey_workflow_editor_run_start_admission",
        "owner": "basekey-frontend",
        "authoritative_record": "docs/openapi/workflow-v1.generated.json#operationId=workflowRunStartAdmissionGet + shared Postgres user_workflow/workflow_execution + runtime capability plan",
        "authoritative_writer": "basekey-frontend/src/server/workflow-api/run-start-admission-handler.ts#handleRunStartAdmissionGet",
        "key_version_hash": "e7811d7d40e7a410f04f7faf2dfd4b26ff4eb1783782a877f000e800703c11fe",
        "observed_at": "runtime request observedAt",
        "expiry_ttl": "request-bound",
        "proof_manifest": "task attachment proof_manifest.json"
      },
      "consumer": "src/components/workflow/editor run-start controls via generated workflow client"
    },
    {
      "operation_id": "workflowEditorContractGet",
      "path": "/api/workflow/editor-contract",
      "method": "GET",
      "route_file": "src/routes/api/workflow/editor-contract.tsx",
      "classification": "public",
      "canonical_owner": "src/contracts/workflow/editor-contract-v1.ts#buildEditorContractV1Response",
      "authoritative_writer": "scripts/contracts/generate-editor-contract.mjs",
      "consumer": "generated workflow client callers"
    }
  ]
}