src/app/api/. Exact request schemas are enforced in each route.ts; this page groups the surface by trust boundary.
Internal routes cover stage claims and finalization, outbox delivery, job context, analysis, strategy, editorial plans, actions, receipts, verification, usage, budgets, assets, notifications, retention, and proactive cycles. An
internal URL is not a security boundary by itself; deployment identity and server-side authentication are required.
Production-plan routes create immutable revisions, expose the current plan, seal the exact revision, record the approval decision, and request cost-free rerenders. Internal production routes claim mandate-bound operations, persist source and provider submissions, attach generated artifacts, and finalize explicit failures. POST /api/internal/production-outbox publishes eligible production work; SQS delivery does not grant provider authority.
Large-batch workers use /api/internal/data-plane/batches, the batch dispatch and outcome routes, and per-item claim/finalize routes. SQS delivery never grants write authority by itself; the internal identity, tenant scope, lease token digest, and epoch fence do.
Operational control endpoints
GET /api/operations/shell
Authentication: operator session. Query parameter after is -1 or a non-negative sequence number; the default is -1.
The response contains:
snapshot.snapshotSequence: latest durable feed sequence;snapshot.jobs: job shells keyed by job ID;snapshot.attention: unresolved attention items keyed by attention ID;updates: ordered changes newer thanafter, up to 500 records;resumable: alwaystruefor this feed.
400. The current snapshot remains authoritative when a client has no cursor or must reset local state.
POST /api/jobs/{id}/control
Authentication: workspace administrator using a browser operator session.
action is pause, resume, or cancel. Cancellation also requires "confirmation": "CANCEL {jobId}". The server derives the actor from the authenticated principal. An accepted command returns 200 with its immutable receipt. A valid but rejected transition, including a stale epoch, returns 409 with the rejected receipt. Invalid input returns 400.
Steering endpoints
POST /api/jobs/{id}/steering/nudges proposes a bounded instruction and returns its exact impact digest. POST /api/jobs/{id}/steering/nudges/{nudgeId}/apply accepts that digest, revokes affected approvals and prepared effects atomically, advances the control epoch, and queues a generation-fenced stage execution. Gate stages rewind to their owning production stage; terminal stages reject steering.
POST /api/jobs/{id}/steering/redo requires expectedControlEpoch, targetStage, and exact confirmation equal to REDO {targetStage}. Redo refuses to cross executed external effects. These steering routes require an authenticated operator and enforce both workspace and brand ownership.
Data-plane endpoints
All data-plane routes require the internal service boundary and tenant headers established by that boundary.
Batch manifests permit 1 to 1,000,000 items. DynamoDB initialization writes at most 400 work items per commit. Dispatch concurrency is 1 to 100; claim attempt budgets are 1 to 20. Successful finalization requires at least one persisted artifact ID.