@feltdb/core 0.7.3 → 0.8.0

package/dist/create/server-source/crates/feltdb-server/src/main.rs

@@ -30,7 +30,8 @@ use axum::{
 use base64::Engine;
 use feltdb::{
     application::{
-        ActionOperation, ApplicationManifest, ApplicationStore, PreviewDataMode, PreviewPolicy,
+        diff_manifests, manifest_hash, validate_manifest, ActionOperation, ApplicationManifest,
+        ApplicationRevision, ApplicationStore, PreviewDataMode, PreviewPolicy, RevisionStatus,
     },
     application_runtime::{
         resolve_runtime, runtime_readiness, snapshot_state_namespace, validate_runtime,
@@ -41,12 +42,15 @@ use feltdb::{
         Grant, GrantSigner, GrantStore, Subject as GrantSubject,
     },
     cardinality_endpoint::{CardinalityContext, CardinalityDiagnosticResponse},
-    AtomicMutation,
-    policy_evaluation::{Actor, PolicyContext, PolicyEvaluator, PolicySubject},
+    policy_evaluation::{
+        Actor, AuthorizationState, PolicyContext, PolicyEvaluator, PolicySubject,
+        RecordAuthorizationContext,
+    },
     state_contract::{
         begin_read, compare_schemas, execute_query as execute_state_query, execute_transaction,
-        execute_transaction_with_collection_policies, schema_from_revision, validate_schema, AuthorizationContext, CanonicalQuery, QueryFilter,
-        StateSchema, TransactionOperation, TransactionOperationKind, TransactionRequest,
+        execute_transaction_with_collection_policies, schema_from_revision, validate_schema,
+        AuthorizationContext, CanonicalQuery, QueryFilter, StateSchema, TransactionOperation,
+        TransactionOperationKind, TransactionRequest,
     },
     sync_contract::{
         DeviceIdentity, ReconciliationOutcome, SyncAck, SyncBatch, SyncConflict, SyncCursor,
@@ -57,7 +61,8 @@ use feltdb::{
         WorkerRegistration,
     },
     workload::{CreateWorkload, WorkloadStore},
-    DatabaseSnapshot, FeltDb, JsonCasResult, Operation, PeerAdvertisement, PeerId, StoredRow, FlowError, RecordPrecondition,
+    AtomicMutation, DatabaseSnapshot, FeltDb, FlowError, JsonCasResult, Operation,
+    PeerAdvertisement, PeerId, RecordPrecondition, StoredRow,
 };
 use feltdb_server::{
     app_state::{AppState, BoundedQueryCursor},
@@ -109,7 +114,10 @@ impl ApiError {
     /// `api_error_body` already parses a message that happens to be JSON, so
     /// this is the existing mechanism named rather than a second one.
     fn structured(status: StatusCode, body: Value) -> Self {
-        Self(status, serde_json::to_string(&body).unwrap_or_else(|_| body.to_string()))
+        Self(
+            status,
+            serde_json::to_string(&body).unwrap_or_else(|_| body.to_string()),
+        )
     }
 }
 
@@ -121,10 +129,44 @@ impl IntoResponse for ApiError {
 }
 
 fn api_error_body(status: StatusCode, message: String) -> Value {
-    if status == StatusCode::FORBIDDEN {
-        return json!({ "error": "AUTHORIZATION_DENIED" });
-    }
-    serde_json::from_str::<Value>(&message).unwrap_or_else(|_| json!({ "error": message }))
+    let request_id = format!("req_{}", uuid::Uuid::new_v4().simple());
+    let code = match status {
+        StatusCode::UNAUTHORIZED => "AUTHENTICATION_REQUIRED",
+        StatusCode::FORBIDDEN => "FORBIDDEN",
+        StatusCode::NOT_FOUND => "NOT_FOUND",
+        StatusCode::CONFLICT => "CONFLICT",
+        StatusCode::TOO_MANY_REQUESTS => "QUERY_LIMIT_EXCEEDED",
+        StatusCode::SERVICE_UNAVAILABLE => "SERVICE_UNAVAILABLE",
+        StatusCode::BAD_REQUEST | StatusCode::UNPROCESSABLE_ENTITY => "VALIDATION_ERROR",
+        _ if status.is_server_error() => "EXECUTION_FAILED",
+        _ => "REQUEST_FAILED",
+    };
+    let parsed =
+        serde_json::from_str::<Value>(&message).unwrap_or_else(|_| json!({ "message": message }));
+    let mut body = if parsed.is_object() {
+        parsed
+    } else {
+        json!({ "message": parsed })
+    };
+    let object = body
+        .as_object_mut()
+        .expect("normalized error body is an object");
+    let resolved_code = object
+        .get("code")
+        .and_then(Value::as_str)
+        .unwrap_or(code)
+        .to_string();
+    object.insert("error".into(), json!(resolved_code));
+    object.insert("code".into(), json!(resolved_code));
+    object.entry("message").or_insert_with(|| {
+        json!(if status == StatusCode::FORBIDDEN {
+            "request is not authorized"
+        } else {
+            status.canonical_reason().unwrap_or("request failed")
+        })
+    });
+    object.insert("request_id".into(), json!(request_id));
+    body
 }
 
 impl From<feltdb::FlowError> for ApiError {
@@ -390,6 +432,96 @@ struct RuntimeEnvironmentRequest {
     environment: String,
 }
 #[derive(Deserialize)]
+struct ApplicationDiscoveryRequest {
+    application_id: String,
+    #[serde(default = "production_environment")]
+    environment: String,
+}
+#[derive(Deserialize)]
+struct ProposalScopeRequest {
+    application_id: String,
+    #[serde(default = "production_environment")]
+    environment: String,
+    #[serde(default)]
+    status: Option<String>,
+    #[serde(default)]
+    limit: Option<usize>,
+    #[serde(default)]
+    cursor: Option<String>,
+}
+#[derive(Deserialize)]
+struct CreateProposalRequest {
+    application_id: String,
+    #[serde(default = "production_environment")]
+    environment: String,
+    base_contract_hash: String,
+    base_flow_hash: String,
+    proposed_flow: String,
+    #[serde(default)]
+    proposal_version: Option<u64>,
+    #[serde(default)]
+    contract_diff: Option<Value>,
+    #[serde(default)]
+    source_plan: Option<Value>,
+    summary: String,
+    #[serde(default)]
+    warnings: Vec<String>,
+    #[serde(default)]
+    metadata: Value,
+    parent_proposal_id: Option<String>,
+    expires_at: Option<String>,
+    #[serde(default)]
+    status: Option<String>,
+}
+#[derive(Deserialize)]
+struct ProposalActorRequest {
+    application_id: String,
+    #[serde(default = "production_environment")]
+    environment: String,
+    proposed_manifest: Option<ApplicationManifest>,
+}
+#[derive(Deserialize)]
+struct ProposalStatusRequest {
+    application_id: String,
+    #[serde(default = "production_environment")]
+    environment: String,
+    status: String,
+    #[serde(default)]
+    approve_authorization: bool,
+    #[serde(default)]
+    reason: Option<String>,
+}
+#[derive(Deserialize)]
+struct ProposalLifecycleRequest {
+    application_id: String,
+    #[serde(default = "production_environment")]
+    environment: String,
+    #[serde(default)]
+    approve_authorization: bool,
+    #[serde(default)]
+    reason: Option<String>,
+}
+#[derive(Deserialize)]
+struct PreviewSimulationRequest {
+    event: String,
+}
+#[derive(Deserialize, Default)]
+struct EventScopeRequest {
+    application_id: Option<String>,
+}
+#[derive(Deserialize)]
+struct SignUpRequest {
+    application_id: String,
+    email: String,
+    password: String,
+    display_name: Option<String>,
+}
+#[derive(Deserialize)]
+struct SignInRequest {
+    email: String,
+    password: String,
+}
+#[derive(Deserialize)]
 struct StateContractTarget {
     application_id: String,
     revision_id: String,
@@ -2236,7 +2368,10 @@ async fn delete_certification_fixture(
         || ring::constant_time::verify_slices_are_equal(expected.as_bytes(), provided.as_bytes())
             .is_err()
     {
-        return Err(ApiError(StatusCode::FORBIDDEN, "certification recovery denied".into()));
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "certification recovery denied".into(),
+        ));
     }
     let tenant_id = state
         .tenancy
@@ -3864,9 +3999,8 @@ async fn commit_application_draft(
         .commit(&tenant, &application_id, &draft_id, &principal.key_id)
         .map_err(manifest_error)?;
     let encoded_revision = percent_encode_path_segment(&revision.revision_id);
-    let mut response = serde_json::to_value(revision).map_err(|error| {
-        ApiError(StatusCode::INTERNAL_SERVER_ERROR, error.to_string())
-    })?;
+    let mut response = serde_json::to_value(revision)
+        .map_err(|error| ApiError(StatusCode::INTERNAL_SERVER_ERROR, error.to_string()))?;
     response
         .as_object_mut()
         .expect("application revisions serialize as objects")
@@ -4346,62 +4480,1403 @@ fn runtime_inventory(
         .iter()
         .filter(|binding| binding.provider.is_none())
     {
-        capabilities.insert(binding.name.clone());
+        capabilities.insert(binding.name.clone());
+    }
+    Ok(RuntimeInventory {
+        capabilities,
+        connections: connection_ids,
+        enforce_availability: true,
+    })
+}
+fn revision_contract(
+    state: &AppState,
+    actor: &str,
+    application_id: &str,
+    revision_id: &str,
+    environment: &str,
+) -> Result<ApplicationRuntimeContract, ApiError> {
+    let tenant = application_scope(state, actor, application_id, "application:revision:read")?;
+    let revision = state
+        .applications
+        .revision(&tenant, application_id, revision_id)
+        .ok_or(ApiError(StatusCode::NOT_FOUND, "revision not found".into()))?;
+    let inventory = runtime_inventory(state, actor, application_id, &revision.manifest)?;
+    resolve_runtime(&revision, environment, &inventory).map_err(|report| {
+        ApiError(
+            StatusCode::CONFLICT,
+            serde_json::to_string(&report).unwrap_or_else(|_| "runtime validation failed".into()),
+        )
+    })
+}
+async fn get_active_application_runtime(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(application_id): Path<String>,
+    Query(input): Query<RuntimeEnvironmentRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let app = state
+        .tenancy
+        .application_for(&principal.key_id, &application_id)
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application not found".into(),
+        ))?;
+    let pointers = state.applications.pointers(&application_id);
+    let revision = pointers.get(&input.environment).ok_or(ApiError(
+        StatusCode::CONFLICT,
+        "application has no revision promoted to this environment".into(),
+    ))?;
+    let contract = revision_contract(
+        &state,
+        &principal.key_id,
+        &application_id,
+        revision,
+        &input.environment,
+    )?;
+    Ok(Json(
+        json!({"contract":contract,"runtime":state.runtimes.active(&app.tenant_id,&application_id,revision,&input.environment)}),
+    ))
+}
+async fn discover_application(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Query(input): Query<ApplicationDiscoveryRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
+    let revision_id = state
+        .applications
+        .pointers(&input.application_id)
+        .get(&input.environment)
+        .cloned()
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application environment has no active contract".into(),
+        ))?;
+    let revision = state
+        .applications
+        .revision(&tenant, &input.application_id, &revision_id)
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application revision not found".into(),
+        ))?;
+    let contract_hash = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.contract_hash")
+        .unwrap_or(&revision.manifest_hash);
+    let dsl_version = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.dsl_version")
+        .and_then(|value| value.parse::<u32>().ok())
+        .unwrap_or(1);
+    let application_name = state
+        .tenancy
+        .application_for(&principal.key_id, &input.application_id)
+        .map(|application| application.name);
+    let flow_hash = revision.manifest.metadata.labels.get("feltdb.flow_hash");
+    Ok(Json(json!({
+        "application_id": input.application_id,
+        "application_name": application_name,
+        "environment": input.environment,
+        "version": revision.revision_number,
+        "revision_id": revision.revision_id,
+        "contract_hash": contract_hash,
+        "flow_hash": flow_hash,
+        "dsl_version": dsl_version,
+        "snapshot": {
+            "application": { "application_id": input.application_id, "environment": input.environment },
+            "contract_version": revision.revision_number,
+            "contract_hash": contract_hash,
+            "dsl_version": dsl_version,
+            "schema": revision.manifest.collections,
+            "indexes": revision.manifest.indexes,
+            "policies": revision.manifest.policies,
+            "workflows": revision.manifest.workflows,
+            "agents": revision.manifest.agents,
+            "capabilities": revision.manifest.capabilities,
+            "modules": revision.manifest.modules,
+            "supported_primitives": ["text","integer","number","boolean","datetime","date","time","json","uuid","decimal","money","bigint","email","url","phone","binary","file","geo","object"]
+        }
+    })))
+}
+
+const DEFAULT_INSPECTION_LIMIT: usize = 50;
+const MAX_INSPECTION_LIMIT: usize = 100;
+fn inspection_error(status: StatusCode, code: &str, message: impl Into<String>) -> ApiError {
+    ApiError::structured(status, json!({"code":code,"message":message.into()}))
+}
+fn active_inspection_contract(
+    state: &AppState,
+    principal: &Principal,
+    application_id: &str,
+    environment: &str,
+) -> Result<ApplicationRuntimeContract, ApiError> {
+    application_scope(state, &principal.key_id, application_id, "state:read")?;
+    let revision = state
+        .applications
+        .pointers(application_id)
+        .get(environment)
+        .cloned()
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::NOT_FOUND,
+                "collection_not_found",
+                "application environment has no active contract",
+            )
+        })?;
+    revision_contract(
+        state,
+        &principal.key_id,
+        application_id,
+        &revision,
+        environment,
+    )
+}
+fn inspectable_collection<'a>(
+    contract: &'a ApplicationRuntimeContract,
+    collection: &str,
+) -> Result<&'a feltdb::state_contract::CollectionSchema, ApiError> {
+    if collection.starts_with("_feltdb") {
+        return Err(inspection_error(
+            StatusCode::FORBIDDEN,
+            "system_collection",
+            "system collections require their dedicated Service API",
+        ));
+    }
+    contract
+        .state
+        .schema
+        .collections
+        .iter()
+        .find(|value| value.name == collection)
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::NOT_FOUND,
+                "collection_not_found",
+                format!("collection {collection} is not part of the active application contract"),
+            )
+        })
+}
+fn secret_name(name: &str) -> bool {
+    let value = name.to_ascii_lowercase();
+    [
+        "secret",
+        "password",
+        "token",
+        "api_key",
+        "apikey",
+        "credential",
+        "private_key",
+    ]
+    .iter()
+    .any(|part| value.contains(part))
+}
+fn redact_inspection_value(value: &mut Value) {
+    match value {
+        Value::Object(object) => {
+            for (key, child) in object.iter_mut() {
+                if key.eq_ignore_ascii_case("secrets") && child.is_array() {
+                    redact_inspection_value(child)
+                } else if secret_name(key) {
+                    *child = json!("[REDACTED]")
+                } else {
+                    redact_inspection_value(child)
+                }
+            }
+        }
+        Value::Array(values) => {
+            for child in values {
+                redact_inspection_value(child)
+            }
+        }
+        Value::String(text)
+            if text.contains("sk_live_")
+                || text.contains("sk_test_")
+                || text.contains("whsec_")
+                || text.contains("-----BEGIN PRIVATE KEY-----") =>
+        {
+            *value = json!("[REDACTED]")
+        }
+        _ => {}
+    }
+}
+fn relationship_metadata(
+    contract: &ApplicationRuntimeContract,
+    collection: &str,
+    record: &Value,
+) -> Vec<Value> {
+    let Some(definition) = contract
+        .state
+        .collections
+        .iter()
+        .find(|value| value.name == collection)
+    else {
+        return vec![];
+    };
+    definition.fields.iter().filter_map(|field|field.reference.as_ref().and_then(|target|record.get(&field.name).and_then(Value::as_str).map(|id|json!({"name":field.name,"source_collection":collection,"target_collection":target,"cardinality":"one","foreign_field":field.name,"reference":{"collection":target,"id":id}})))).collect()
+}
+fn inspection_cursor(
+    collection: &str,
+    state_version: u64,
+    after: &str,
+    filter_hash: &str,
+) -> String {
+    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(serde_json::to_vec(&json!({"v":1,"state":state_version,"after":after,"query":format!("{:x}",Sha256::digest(format!("{collection}:{filter_hash}").as_bytes()))})).unwrap_or_default())
+}
+fn parse_inspection_cursor(
+    cursor: &str,
+    collection: &str,
+    current_version: u64,
+    filter_hash: &str,
+) -> Result<String, ApiError> {
+    let value = base64::engine::general_purpose::URL_SAFE_NO_PAD
+        .decode(cursor)
+        .ok()
+        .and_then(|bytes| serde_json::from_slice::<Value>(&bytes).ok())
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "invalid_cursor",
+                "cursor is malformed",
+            )
+        })?;
+    let expected = format!(
+        "{:x}",
+        Sha256::digest(format!("{collection}:{filter_hash}").as_bytes())
+    );
+    if value.get("v").and_then(Value::as_u64) != Some(1)
+        || value.get("state").and_then(Value::as_u64) != Some(current_version)
+        || value.get("query").and_then(Value::as_str) != Some(&expected)
+    {
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_cursor",
+            "cursor is stale or belongs to another query",
+        ));
+    }
+    value
+        .get("after")
+        .and_then(Value::as_str)
+        .map(str::to_string)
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "invalid_cursor",
+                "cursor position is invalid",
+            )
+        })
+}
+async fn inspect_application_schema(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Query(input): Query<ApplicationDiscoveryRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let contract = active_inspection_contract(
+        &state,
+        &principal,
+        &input.application_id,
+        &input.environment,
+    )?;
+    let collections=contract.state.collections.iter().map(|collection|{let policy=matching_state_policy(&contract,&collection.name);
+        let relationships=collection.fields.iter().filter_map(|field|field.reference.as_ref().map(|target|json!({"name":field.name,"source_collection":collection.name,"target_collection":target,"cardinality":"one","foreign_field":field.name}))).collect::<Vec<_>>();
+        let reverse=contract.state.collections.iter().flat_map(|source|source.fields.iter().filter_map(|field|field.reference.as_ref().filter(|target|*target==&collection.name).map(|_|json!({"name":format!("{}_{}",source.name,field.name),"source_collection":source.name,"target_collection":collection.name,"cardinality":"many","foreign_field":field.name})))).collect::<Vec<_>>();
+        json!({"collection":collection.name,"description":"","fields":collection.fields,"relationships":relationships.into_iter().chain(reverse).collect::<Vec<_>>(),"indexes":contract.state.indexes.iter().filter(|index|index.collection==collection.name).collect::<Vec<_>>(),"authorization":policy.map(|value|json!({"read":value.read,"write":value.write,"capabilities":value.capabilities}))})}).collect::<Vec<_>>();
+    Ok(Json(
+        json!({"application":{"application_id":input.application_id,"environment":input.environment},"contract_version":contract.revision_number,"collections":collections}),
+    ))
+}
+async fn inspect_collection(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(collection): Path<String>,
+    Query(params): Query<HashMap<String, String>>,
+) -> Result<Json<Value>, ApiError> {
+    let application_id = params.get("application_id").ok_or_else(|| {
+        inspection_error(
+            StatusCode::BAD_REQUEST,
+            "inspection_not_allowed",
+            "application_id is required",
+        )
+    })?;
+    let environment = params
+        .get("environment")
+        .map(String::as_str)
+        .unwrap_or("production");
+    let contract = active_inspection_contract(&state, &principal, application_id, environment)?;
+    let definition = inspectable_collection(&contract, &collection)?;
+    let limit = params
+        .get("limit")
+        .map(|value| value.parse::<usize>())
+        .transpose()
+        .map_err(|_| {
+            inspection_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "invalid_pagination",
+                "limit must be an integer",
+            )
+        })?
+        .unwrap_or(DEFAULT_INSPECTION_LIMIT);
+    if limit == 0 || limit > MAX_INSPECTION_LIMIT {
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_pagination",
+            format!("limit must be between 1 and {MAX_INSPECTION_LIMIT}"),
+        ));
+    }
+    let reserved = ["application_id", "environment", "limit", "cursor"];
+    let mut filters = Vec::new();
+    for (field, value) in params
+        .iter()
+        .filter(|(key, _)| !reserved.contains(&key.as_str()))
+    {
+        if field.contains('[') || field.contains(']') {
+            return Err(inspection_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "unsupported_filter",
+                format!("unsupported filter operator in {field}"),
+            ));
+        }
+        if !definition
+            .fields
+            .iter()
+            .any(|candidate| candidate.name == *field)
+        {
+            return Err(inspection_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "field_not_found",
+                format!("field {field} is not in collection {collection}"),
+            ));
+        }
+        filters.push(QueryFilter::Eq {
+            field: field.clone(),
+            value: Value::String(value.clone()),
+        });
+    }
+    filters.sort_by(|left, right| format!("{left:?}").cmp(&format!("{right:?}")));
+    let filter_hash = format!(
+        "{:x}",
+        Sha256::digest(serde_json::to_vec(&filters).unwrap_or_default())
+    );
+    let state_version = state.db.sequence()?;
+    let mut after = params
+        .get("cursor")
+        .map(|value| parse_inspection_cursor(value, &collection, state_version, &filter_hash))
+        .transpose()?;
+    let policy = matching_state_policy(&contract, &collection).ok_or_else(|| {
+        inspection_error(
+            StatusCode::FORBIDDEN,
+            "inspection_not_allowed",
+            "collection has no inspection policy",
+        )
+    })?;
+    let read_policy = policy.read.as_deref().and_then(PolicySubject::from_str);
+    if read_policy.is_none()
+        && !policy
+            .capabilities
+            .iter()
+            .any(|value| value == "state:read")
+    {
+        return Err(inspection_error(
+            StatusCode::FORBIDDEN,
+            "forbidden",
+            "application policy denies collection inspection",
+        ));
+    }
+    let auth_state = if matches!(read_policy, Some(PolicySubject::Member)) {
+        Some(AuthorizationState::new(
+            std::sync::Arc::new(contract.state.schema.clone()),
+            contract.environment.state_namespace.clone(),
+            std::sync::Arc::new(state.db.state_rows()?),
+        ))
+    } else {
+        None
+    };
+    let capability = format!("{}:{}", contract.environment.state_namespace, collection);
+    let mut accepted: Vec<(String, Value)> = Vec::new();
+    let mut exhausted = false;
+    while accepted.len() <= limit && !exhausted {
+        let page = state
+            .db
+            .list_collection_page(&capability, after.as_deref(), 256)?;
+        if page.len() < 256 {
+            exhausted = true;
+        }
+        if page.is_empty() {
+            break;
+        }
+        for row in page {
+            after = Some(row.key.clone());
+            if !filters.iter().all(|filter| match filter {
+                QueryFilter::Eq { field, value } => row.value.get(field) == Some(value),
+                _ => false,
+            }) {
+                continue;
+            }
+            if let Some(subject) = read_policy.clone() {
+                let mut context = RecordAuthorizationContext::new(
+                    Some(Actor::new(&principal.key_id)),
+                    collection.clone(),
+                    row.key.clone(),
+                    row.value.clone(),
+                );
+                if let Some(snapshot) = auth_state.clone() {
+                    context = context.with_state(snapshot);
+                }
+                if PolicyEvaluator::evaluate_record(subject, &context).is_err() {
+                    continue;
+                }
+            }
+            accepted.push((row.key, row.value));
+            if accepted.len() > limit {
+                break;
+            }
+        }
+    }
+    let has_more = accepted.len() > limit;
+    let last_key = accepted
+        .get(limit.saturating_sub(1))
+        .map(|value| value.0.clone());
+    let records = accepted
+        .into_iter()
+        .take(limit)
+        .map(|(id, mut record)| {
+            let relationships = relationship_metadata(&contract, &collection, &record);
+            redact_inspection_value(&mut record);
+            if let Some(object) = record.as_object_mut() {
+                object.entry("id").or_insert(json!(id));
+                object.insert("_relationships".into(), json!(relationships));
+            }
+            record
+        })
+        .collect::<Vec<_>>();
+    Ok(Json(
+        json!({"collection":collection,"records":records,"pagination":{"limit":limit,"nextCursor":if has_more{last_key.map(|key|inspection_cursor(&collection,state_version,&key,&filter_hash))}else{None}},"state_version":state_version}),
+    ))
+}
+async fn inspect_record(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path((collection, id)): Path<(String, String)>,
+    Query(params): Query<HashMap<String, String>>,
+) -> Result<Json<Value>, ApiError> {
+    let application_id = params.get("application_id").ok_or_else(|| {
+        inspection_error(
+            StatusCode::BAD_REQUEST,
+            "inspection_not_allowed",
+            "application_id is required",
+        )
+    })?;
+    let environment = params
+        .get("environment")
+        .map(String::as_str)
+        .unwrap_or("production");
+    let contract = active_inspection_contract(&state, &principal, application_id, environment)?;
+    inspectable_collection(&contract, &collection)?;
+    let policy = matching_state_policy(&contract, &collection).ok_or_else(|| {
+        inspection_error(
+            StatusCode::FORBIDDEN,
+            "inspection_not_allowed",
+            "collection has no inspection policy",
+        )
+    })?;
+    let read_policy = policy.read.as_deref().and_then(PolicySubject::from_str);
+    if read_policy.is_none()
+        && !policy
+            .capabilities
+            .iter()
+            .any(|value| value == "state:read")
+    {
+        return Err(inspection_error(
+            StatusCode::FORBIDDEN,
+            "forbidden",
+            "application policy denies record inspection",
+        ));
+    }
+    let capability = format!("{}:{}", contract.environment.state_namespace, collection);
+    let row = state
+        .db
+        .get_collection_record(&capability, &id)?
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::NOT_FOUND,
+                "record_not_found",
+                "record not found or is not authorized",
+            )
+        })?;
+    if let Some(subject) = read_policy {
+        let mut context = RecordAuthorizationContext::new(
+            Some(Actor::new(&principal.key_id)),
+            collection.clone(),
+            id.clone(),
+            row.value.clone(),
+        );
+        if matches!(subject, PolicySubject::Member) {
+            context = context.with_state(AuthorizationState::new(
+                std::sync::Arc::new(contract.state.schema.clone()),
+                contract.environment.state_namespace.clone(),
+                std::sync::Arc::new(state.db.state_rows()?),
+            ));
+        }
+        if PolicyEvaluator::evaluate_record(subject, &context).is_err() {
+            return Err(inspection_error(
+                StatusCode::NOT_FOUND,
+                "record_not_found",
+                "record not found or is not authorized",
+            ));
+        }
+    }
+    let mut record = row.value;
+    let relationships = relationship_metadata(&contract, &collection, &record);
+    redact_inspection_value(&mut record);
+    if let Some(object) = record.as_object_mut() {
+        object.insert("id".into(), json!(id));
+    }
+    Ok(Json(
+        json!({"collection":collection,"record":record,"relationships":relationships}),
+    ))
+}
+const PROPOSAL_COLLECTION: &str = "_feltdb_proposals";
+const PROPOSAL_EVENT_COLLECTION: &str = "_feltdb_proposal_events";
+const PROPOSAL_PREVIEW_COLLECTION: &str = "_feltdb_proposal_previews";
+
+fn proposal_contract_snapshot(
+    revision: &ApplicationRevision,
+    environment: &str,
+) -> Value {
+    let contract_hash = revision.manifest.metadata.labels.get("feltdb.contract_hash").unwrap_or(&revision.manifest_hash);
+    let flow_hash = revision.manifest.metadata.labels.get("feltdb.flow_hash").cloned();
+    let dsl_version = revision.manifest.metadata.labels.get("feltdb.dsl_version").and_then(|value| value.parse::<u32>().ok()).unwrap_or(1);
+    json!({
+        "application":{"application_id":revision.application_id,"environment":environment},
+        "contract_version":revision.revision_number,"contract_hash":contract_hash,"flow_hash":flow_hash,
+        "dsl_version":dsl_version,"schema":revision.manifest.collections,"indexes":revision.manifest.indexes,
+        "policies":revision.manifest.policies,"workflows":revision.manifest.workflows,"agents":revision.manifest.agents,
+        "capabilities":revision.manifest.capabilities,"modules":revision.manifest.modules,
+        "supported_primitives":["text","integer","number","boolean","datetime","date","time","json","uuid","decimal","money","bigint","email","url","phone","binary","file","geo","object"]
+    })
+}
+
+fn proposal_hash(value: &Value) -> String {
+    format!("sha256:{:x}", Sha256::digest(serde_json::to_vec(value).unwrap_or_default()))
+}
+
+fn preview_ttl_seconds() -> i64 {
+    std::env::var("FELTDB_PROPOSAL_PREVIEW_TTL_SECONDS").ok().and_then(|value| value.parse().ok()).map(|value: i64| value.clamp(1, 86_400)).unwrap_or(3_600)
+}
+
+fn preview_artifact(state: &AppState, id: &str) -> Result<Value, ApiError> {
+    required_value(state, PROPOSAL_PREVIEW_COLLECTION, id, "preview not found")
+}
+
+fn preview_available(value: &Value) -> bool {
+    value.get("status").and_then(Value::as_str) == Some("ready")
+        && value.get("expires_at").and_then(Value::as_i64).is_some_and(|expires| expires > unix_seconds_i64())
+}
+
+fn proposal_event(
+    state: &AppState,
+    proposal_id: &str,
+    from: Option<&str>,
+    to: &str,
+    actor: &str,
+) -> Result<(), ApiError> {
+    let id = format!("pe_{}", uuid::Uuid::new_v4().simple());
+    let proposal = proposal_value(state, proposal_id).unwrap_or(Value::Null);
+    let event_sequence = state.db.sequence()?.saturating_add(1);
+    insert_canonical(
+        state,
+        PROPOSAL_EVENT_COLLECTION,
+        &id,
+        json!({ "id":id, "event_id":id, "proposal_id":proposal_id, "event_type":to,
+        "from_status":from, "to_status":to, "actor":actor, "created_at":unix_seconds_i64(),
+        "timestamp":unix_seconds_i64(), "event_sequence":event_sequence, "contract_hash":proposal.get("base_contract_hash"),
+        "flow_hash":proposal.get("base_flow_hash"), "metadata":{} }),
+    )?;
+    Ok(())
+}
+fn proposal_value(state: &AppState, id: &str) -> Result<Value, ApiError> {
+    required_value(state, PROPOSAL_COLLECTION, id, "proposal not found")
+}
+fn proposal_scope_matches(value: &Value, application_id: &str, environment: &str) -> bool {
+    value.get("application_id").and_then(Value::as_str) == Some(application_id)
+        && value.get("environment").and_then(Value::as_str) == Some(environment)
+}
+async fn create_proposal(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Json(input): Json<CreateProposalRequest>,
+) -> Result<(StatusCode, Json<Value>), ApiError> {
+    if input.status.is_some() {
+        return Err(inspection_error(StatusCode::BAD_REQUEST, "invalid_proposal", "proposal lifecycle state is server-controlled"));
+    }
+    if input.proposal_version.unwrap_or(1) != 1 {
+        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_proposal", "proposal_version must be 1"));
+    }
+    if input.contract_diff.as_ref().is_none_or(|value| !value.is_array())
+        || input.source_plan.as_ref().is_none_or(|value| !value.get("files").is_some_and(Value::is_array))
+    {
+        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_proposal", "contract_diff and source_plan.files are required arrays"));
+    }
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:write",
+    )?;
+    let revision_id = state
+        .applications
+        .pointers(&input.application_id)
+        .get(&input.environment)
+        .cloned()
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application environment has no active contract".into(),
+        ))?;
+    let revision = state
+        .applications
+        .revision(&tenant, &input.application_id, &revision_id)
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application revision not found".into(),
+        ))?;
+    let contract_hash = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.contract_hash")
+        .unwrap_or(&revision.manifest_hash);
+    if input.base_contract_hash != *contract_hash {
+        return Err(ApiError(
+            StatusCode::CONFLICT,
+            "STALE_PROPOSAL: base contract does not match active contract".into(),
+        ));
+    }
+    if input.proposed_flow.trim().is_empty() || input.base_flow_hash.trim().is_empty() {
+        return Err(ApiError(
+            StatusCode::BAD_REQUEST,
+            "proposed_flow and base_flow_hash are required".into(),
+        ));
+    }
+    let id = format!("p_{}", uuid::Uuid::new_v4().simple());
+    let now = unix_seconds_i64();
+    let mut value = json!({ "id":id, "application_id":input.application_id, "environment":input.environment,
+        "status":"proposed", "proposal_version":1, "base_contract_version":revision.revision_number,
+        "base_contract_hash":input.base_contract_hash, "base_flow_hash":input.base_flow_hash, "proposed_flow":input.proposed_flow,
+        "contract_diff":input.contract_diff.unwrap_or_else(||json!([])), "source_plan":input.source_plan.unwrap_or_else(||json!({"files":[]})), "summary":input.summary, "warnings":input.warnings,
+        "created_by":principal.key_id, "created_at":now, "expires_at":input.expires_at, "metadata":input.metadata,
+        "parent_proposal_id":input.parent_proposal_id,
+        "base_module_versions": revision.manifest.modules.iter().filter_map(|module| Some(json!({
+            "id": module.get("id")?, "provider": module.get("provider")?, "version": module.get("version")?
+        }))).collect::<Vec<_>>(),
+        "module_versions": revision.manifest.modules.iter().filter_map(|module| Some(json!({
+        "id": module.get("id")?, "provider": module.get("provider")?, "version": module.get("version")?
+        }))).collect::<Vec<_>>() });
+    redact_inspection_value(&mut value);
+    insert_canonical(&state, PROPOSAL_COLLECTION, &id, value.clone())?;
+    proposal_event(&state, &id, None, "proposed", &principal.key_id)?;
+    Ok((StatusCode::CREATED, Json(value)))
+}
+async fn list_proposals(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
+    let limit = input.limit.unwrap_or(DEFAULT_INSPECTION_LIMIT);
+    if limit == 0 || limit > MAX_INSPECTION_LIMIT {
+        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_pagination", format!("limit must be between 1 and {MAX_INSPECTION_LIMIT}")));
+    }
+    if input.status.as_ref().is_some_and(|status| !matches!(status.as_str(), "proposed"|"validated"|"previewed"|"approved"|"applied"|"rejected"|"expired")) {
+        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "unsupported_filter", "unsupported proposal status"));
+    }
+    let filter_hash = format!("{}:{}:{}", input.application_id, input.environment, input.status.as_deref().unwrap_or("*"));
+    let state_version = state.db.sequence()?;
+    let mut after = input.cursor.as_deref().map(|cursor| parse_inspection_cursor(cursor, PROPOSAL_COLLECTION, state_version, &filter_hash)).transpose()?;
+    let mut accepted = Vec::new();
+    let mut exhausted = false;
+    while accepted.len() <= limit && !exhausted {
+        let page = state.db.list_collection_page(PROPOSAL_COLLECTION, after.as_deref(), 256)?;
+        if page.len() < 256 { exhausted = true; }
+        if page.is_empty() { break; }
+        for row in page {
+            after = Some(row.key.clone());
+            if !proposal_scope_matches(&row.value, &input.application_id, &input.environment) { continue; }
+            if input.status.as_ref().is_some_and(|status| row.value.get("status").and_then(Value::as_str) != Some(status)) { continue; }
+            let mut value = row.value;
+            redact_inspection_value(&mut value);
+            accepted.push((row.key, value));
+            if accepted.len() > limit { break; }
+        }
+    }
+    let has_more = accepted.len() > limit;
+    let last_key = accepted.get(limit.saturating_sub(1)).map(|entry| entry.0.clone());
+    let proposals = accepted.into_iter().take(limit).map(|entry| entry.1).collect::<Vec<_>>();
+    let next_cursor = if has_more { last_key.map(|key| inspection_cursor(PROPOSAL_COLLECTION, state_version, &key, &filter_hash)) } else { None };
+    Ok(Json(json!({"proposals":proposals,"pagination":{"limit":limit,"nextCursor":next_cursor},"state_version":state_version})))
+}
+async fn get_proposal(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
+    let mut value = proposal_value(&state, &id)?;
+    if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
+        return Err(ApiError(StatusCode::NOT_FOUND, "proposal not found".into()));
+    }
+    let mut value = value;
+    redact_inspection_value(&mut value);
+    Ok(Json(value))
+}
+async fn proposal_history(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let _ = get_proposal(
+        State(state.clone()),
+        Extension(principal),
+        Path(id.clone()),
+        Query(input),
+    )
+    .await?;
+    let mut events: Vec<Value> = state
+        .db
+        .list_collection(PROPOSAL_EVENT_COLLECTION)?
+        .into_iter()
+        .map(|row| row.value)
+        .filter(|value| value.get("proposal_id").and_then(Value::as_str) == Some(id.as_str()))
+        .collect();
+    events.sort_by(|left, right| left.get("event_sequence").and_then(Value::as_u64).cmp(&right.get("event_sequence").and_then(Value::as_u64)).then_with(|| left.get("id").and_then(Value::as_str).cmp(&right.get("id").and_then(Value::as_str))));
+    for event in &mut events { redact_inspection_value(event); }
+    Ok(Json(json!({"events":events})))
+}
+fn move_proposal(
+    state: &AppState,
+    id: &str,
+    mut value: Value,
+    to: &str,
+    actor: &str,
+) -> Result<Value, ApiError> {
+    let from = value
+        .get("status")
+        .and_then(Value::as_str)
+        .unwrap_or("")
+        .to_string();
+    let allowed = matches!(
+        (from.as_str(), to),
+        ("proposed", "validated")
+            | ("proposed", "rejected")
+            | ("validated", "previewed")
+            | ("validated", "rejected")
+            | ("previewed", "approved")
+            | ("previewed", "rejected")
+            | ("approved", "applied")
+            | ("approved", "expired")
+    );
+    if !allowed {
+        return Err(ApiError(
+            StatusCode::CONFLICT,
+            format!("INVALID_PROPOSAL_TRANSITION: {from} -> {to}"),
+        ));
+    }
+    value["status"] = json!(to);
+    if to == "approved" {
+        value["approved_by"] = json!(actor);
+        value["approved_at"] = json!(unix_seconds_i64());
+    }
+    if to == "applied" {
+        value["applied_at"] = json!(unix_seconds_i64());
+    }
+    if to == "rejected" {
+        value["rejected_by"] = json!(actor);
+        value["rejected_at"] = json!(unix_seconds_i64());
+    }
+    let _ = put_canonical(state, PROPOSAL_COLLECTION, id, value.clone())?;
+    proposal_event(state, id, Some(&from), to, actor)?;
+    Ok(value)
+}
+
+fn proposal_is_expired(value: &Value) -> bool {
+    value.get("expires_at").and_then(|expires| expires.as_i64().or_else(|| expires.as_str()?.parse().ok())).is_some_and(|expires| expires <= unix_seconds_i64())
+}
+
+fn proposal_readiness_value(
+    state: &AppState,
+    tenant: &str,
+    value: &Value,
+) -> Result<Value, ApiError> {
+    let application_id = value.get("application_id").and_then(Value::as_str).unwrap_or("");
+    let environment = value.get("environment").and_then(Value::as_str).unwrap_or("production");
+    let revision_id = state.applications.pointers(application_id).get(environment).cloned().ok_or_else(|| inspection_error(StatusCode::NOT_FOUND, "application_not_found", "active application contract not found"))?;
+    let revision = state.applications.revision(tenant, application_id, &revision_id).ok_or_else(|| inspection_error(StatusCode::NOT_FOUND, "application_not_found", "active application revision not found"))?;
+    let current_contract_hash = revision.manifest.metadata.labels.get("feltdb.contract_hash").unwrap_or(&revision.manifest_hash).clone();
+    let current_flow_hash = revision.manifest.metadata.labels.get("feltdb.flow_hash").cloned();
+    let proposal_contract_hash = value.get("base_contract_hash").and_then(Value::as_str).unwrap_or("");
+    let proposal_flow_hash = value.get("base_flow_hash").and_then(Value::as_str).unwrap_or("");
+    let current_modules = revision.manifest.modules.iter().filter_map(|module| Some(json!({"id":module.get("id")?,"provider":module.get("provider")?,"version":module.get("version")?}))).collect::<Vec<_>>();
+    let contract_changed = current_contract_hash != proposal_contract_hash;
+    let flow_changed = current_flow_hash.as_deref().is_some_and(|hash| hash != proposal_flow_hash);
+    let modules_changed = value.get("base_module_versions").and_then(Value::as_array).is_some_and(|modules| modules != &current_modules);
+    let expired = proposal_is_expired(value);
+    let mut blockers = Vec::new();
+    if contract_changed { blockers.push("contract_changed"); }
+    if flow_changed { blockers.push("flow_changed"); }
+    if modules_changed { blockers.push("module_versions_changed"); }
+    if expired { blockers.push("expired"); }
+    let stale = contract_changed || flow_changed || modules_changed;
+    Ok(json!({
+        "status":value.get("status"), "readiness":if blockers.is_empty(){"ready"}else{"blocked"},
+        "blockers":blockers, "notes":[], "current_contract_hash":current_contract_hash,
+        "proposal_contract_hash":proposal_contract_hash, "current_flow_hash":current_flow_hash,
+        "proposal_flow_hash":proposal_flow_hash, "stale":stale, "expires_at":value.get("expires_at")
+    }))
+}
+
+async fn proposal_status(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(&state, &principal.key_id, &input.application_id, "application:read")?;
+    let mut value = proposal_value(&state, &id)?;
+    if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
+        return Err(inspection_error(StatusCode::NOT_FOUND, "proposal_not_found", "proposal not found"));
+    }
+    Ok(Json(proposal_readiness_value(&state, &tenant, &value)?))
+}
+async fn validate_proposal(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Json(input): Json<ProposalActorRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:write",
+    )?;
+    let mut value = proposal_value(&state, &id)?;
+    if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
+        return Err(ApiError(StatusCode::NOT_FOUND, "proposal not found".into()));
+    }
+    if value.get("status").and_then(Value::as_str) == Some("validated") {
+        redact_inspection_value(&mut value);
+        return Ok(Json(value));
+    }
+    let revision_id = state
+        .applications
+        .pointers(&input.application_id)
+        .get(&input.environment)
+        .cloned()
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "active contract not found".into(),
+        ))?;
+    let revision = state
+        .applications
+        .revision(&tenant, &input.application_id, &revision_id)
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application revision not found".into(),
+        ))?;
+    let hash = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.contract_hash")
+        .unwrap_or(&revision.manifest_hash);
+    if value.get("base_contract_hash").and_then(Value::as_str) != Some(hash) {
+        return Err(ApiError(StatusCode::CONFLICT, "STALE_PROPOSAL".into()));
+    }
+    if let Some(manifest) = input.proposed_manifest {
+        let report = validate_manifest(
+            &manifest,
+            &tenant,
+            &input.application_id,
+            Some(&revision.manifest),
+        );
+        if !report.valid {
+            return Err(ApiError::structured(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                json!({"code":"INVALID_PROPOSAL","validation":report}),
+            ));
+        }
+        value["module_versions"] = json!(manifest.modules.iter().filter_map(|module| Some(json!({
+            "id": module.get("id")?, "provider": module.get("provider")?, "version": module.get("version")?
+        }))).collect::<Vec<_>>());
+        let module_ids = manifest
+            .modules
+            .iter()
+            .filter_map(|module| module.get("id").and_then(Value::as_str))
+            .collect::<Vec<_>>();
+        let module_models = manifest
+            .collections
+            .iter()
+            .flat_map(|collection| collection.fields.iter())
+            .filter_map(|field| field.reference.as_deref())
+            .filter(|reference| {
+                module_ids
+                    .iter()
+                    .any(|id| reference.starts_with(&format!("{id}.")))
+            })
+            .collect::<Vec<_>>();
+        let relationships = manifest
+            .collections
+            .iter()
+            .flat_map(|collection| {
+                collection.fields.iter().filter_map(|field| {
+                    field.reference.as_ref().map(|reference| {
+                        format!("{}.{} -> {}", collection.name, field.name, reference)
+                    })
+                })
+            })
+            .collect::<Vec<_>>();
+        let ownership = manifest
+            .modules
+            .iter()
+            .flat_map(|module| {
+                let id = module.get("id").and_then(Value::as_str).unwrap_or("");
+                module
+                    .get("models")
+                    .and_then(Value::as_array)
+                    .into_iter()
+                    .flatten()
+                    .filter_map(move |model| {
+                        Some((
+                            format!("{}.{}", id, model.get("name")?.as_str()?),
+                            Value::String(model.get("ownership")?.as_str()?.to_string()),
+                        ))
+                    })
+            })
+            .collect::<serde_json::Map<String, Value>>();
+        value["module_impact"] = json!({
+            "modules":module_ids, "models":module_models, "relationships":relationships,
+            "events":manifest.triggers.iter().filter(|trigger| module_ids.iter().any(|id| trigger.event.starts_with(&format!("{id}.")))).map(|trigger|trigger.event.clone()).collect::<Vec<_>>(),
+            "workflows":manifest.workflows.iter().map(|workflow|workflow.name.clone()).collect::<Vec<_>>(),
+            "capabilities":manifest.capabilities.iter().filter(|capability| capability.provider.as_deref().map(|provider|module_ids.contains(&provider)).unwrap_or(false)).map(|capability|capability.name.clone()).collect::<Vec<_>>(),
+            "authorization":manifest.policies.iter().map(|policy|policy.name.clone()).collect::<Vec<_>>(),
+            "configuration":manifest.modules.iter().flat_map(|module| module.get("configuration").and_then(Value::as_array).into_iter().flatten().filter_map(|item|item.get("name").cloned())).collect::<Vec<_>>(),
+            "secrets":manifest.modules.iter().flat_map(|module| module.get("secrets").and_then(Value::as_array).into_iter().flatten().filter_map(|item|item.get("name").cloned())).collect::<Vec<_>>(),
+            "ownership":ownership,
+            "state_flow":manifest.modules.iter().flat_map(|module| module.get("reconciliation").and_then(Value::as_array).into_iter().flatten().filter_map(|item| Some(format!("{} -> {} -> {}",item.get("event")?.as_str()?,item.get("workflow")?.as_str()?,item.get("outcome")?.as_str()?)))).collect::<Vec<_>>()
+        });
+        let proposed = ApplicationRevision {
+            revision_id: format!("proposal://{id}"),
+            application_id: input.application_id.clone(),
+            tenant_id: tenant,
+            revision_number: revision.revision_number + 1,
+            parent_revision_id: Some(revision.revision_id.clone()),
+            manifest_hash: String::new(),
+            manifest,
+            created_by: principal.key_id.clone(),
+            created_at: unix_seconds_i64() as u64,
+            status: RevisionStatus::Committed,
+        };
+        value["contract_diff"] =
+            serde_json::to_value(diff_manifests(Some(&revision), &proposed).changes)
+                .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+        value["proposed_contract"] = serde_json::to_value(&proposed.manifest)
+            .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+    }
+    value["source_plan"] = json!({"files":[{"path":"feltdb.flow","operation":"modify"},{"path":"src/feltdb/generated-contract.ts","operation":"modify"}]});
+    Ok(Json(move_proposal(
+        &state,
+        &id,
+        value,
+        "validated",
+        &principal.key_id,
+    )?))
+}
+async fn preview_proposal(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Json(input): Json<ProposalActorRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:write",
+    )?;
+    let mut value = proposal_value(&state, &id)?;
+    if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
+        return Err(ApiError(StatusCode::NOT_FOUND, "proposal not found".into()));
+    }
+    let replacing_expired_preview = value.get("status").and_then(Value::as_str) == Some("previewed");
+    if replacing_expired_preview {
+        if let Some(preview_id) = value.get("preview_id").and_then(Value::as_str) {
+            let mut artifact = preview_artifact(&state, preview_id)?;
+            if preview_available(&artifact) {
+                let mut proposal = value.clone();
+                redact_inspection_value(&mut proposal);
+                redact_inspection_value(&mut artifact);
+                if let Some(object) = artifact.as_object_mut() { object.remove("namespace"); }
+                artifact["proposal"] = proposal;
+                return Ok(Json(artifact));
+            }
+        }
+    }
+    if !replacing_expired_preview && value.get("status").and_then(Value::as_str) != Some("validated") {
+        return Err(inspection_error(StatusCode::CONFLICT, "invalid_proposal_transition", "only a validated proposal can be previewed"));
+    }
+    let proposed_manifest: ApplicationManifest = serde_json::from_value(value.get("proposed_contract").cloned().ok_or_else(|| inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "missing_required_semantics", "validated proposal has no proposed contract snapshot"))?).map_err(|error| inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_proposal", error.to_string()))?;
+    let current_revision_id = state.applications.pointers(&input.application_id).get(&input.environment).cloned().ok_or_else(|| inspection_error(StatusCode::NOT_FOUND, "application_not_found", "active application contract not found"))?;
+    let current_revision = state.applications.revision(&tenant, &input.application_id, &current_revision_id).ok_or_else(|| inspection_error(StatusCode::NOT_FOUND, "application_not_found", "active application revision not found"))?;
+    let readiness = proposal_readiness_value(&state, &tenant, &value)?;
+    if readiness.get("readiness").and_then(Value::as_str) != Some("ready") {
+        return Err(ApiError::structured(StatusCode::CONFLICT, json!({"code":"preview_not_ready","message":"proposal cannot be previewed","readiness":readiness})));
+    }
+    let preview_id = format!("pv_{}", uuid::Uuid::new_v4().simple());
+    let preview_environment = format!("preview/proposal/{preview_id}");
+    let proposed_manifest_hash = manifest_hash(&proposed_manifest).map_err(|error| inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "preview_contract_invalid", error))?;
+    let proposed_revision = ApplicationRevision { revision_id:format!("proposal://{id}"), application_id:input.application_id.clone(), tenant_id:tenant,
+        revision_number:value.get("base_contract_version").and_then(Value::as_u64).unwrap_or(current_revision.revision_number)+1,
+        parent_revision_id:Some(current_revision.revision_id.clone()), manifest_hash:proposed_manifest_hash, manifest:proposed_manifest,
+        created_by:principal.key_id.clone(), created_at:unix_seconds_i64() as u64, status:RevisionStatus::Committed };
+    let runtime = resolve_runtime(&proposed_revision, &preview_environment, &RuntimeInventory::default()).map_err(|report| ApiError::structured(StatusCode::UNPROCESSABLE_ENTITY, json!({"code":"preview_contract_invalid","validation":report})))?;
+    let current_contract = proposal_contract_snapshot(&current_revision, &input.environment);
+    let mut proposed_contract = proposal_contract_snapshot(&proposed_revision, &input.environment);
+    proposed_contract["contract_hash"] = json!(proposal_hash(&proposed_contract));
+    proposed_contract["flow_hash"] = json!(format!("sha256:{:x}", Sha256::digest(value.get("proposed_flow").and_then(Value::as_str).unwrap_or("").replace("\r\n", "\n").as_bytes())));
+    let namespace = runtime.environment.state_namespace.clone();
+    let mut seeded_records = Vec::new();
+    for collection in &proposed_revision.manifest.collections {
+        if collection.name.starts_with("_feltdb") { continue; }
+        let record_id = format!("preview_{}", collection.name.to_ascii_lowercase());
+        let record = json!({"id":record_id,"_preview_data":true,"_preview_source":"synthetic","label":format!("Synthetic {} preview",collection.name)});
+        state.db.capability(&format!("{}:{}", namespace, collection.name)).insert_with_key(&record_id, record)?;
+        seeded_records.push(json!({"collection":collection.name,"id":record_id,"preview_data":true}));
+    }
+    let now = unix_seconds_i64();
+    let mut artifact = json!({
+        "preview_id":preview_id,"proposal_id":id,"application_id":input.application_id,"environment":input.environment,
+        "proposal_hash":proposal_hash(&value),"proposal_contract_hash":value.get("base_contract_hash"),"proposal_flow_hash":value.get("base_flow_hash"),
+        "module_versions":value.get("module_versions"),"created_at":now,"expires_at":now+preview_ttl_seconds(),"status":"ready",
+        "namespace":namespace,"current":current_contract,"proposed":proposed_contract,"current_contract":current_contract,
+        "proposed_contract":proposed_contract,"semantic_diff":value.get("contract_diff"),"state_flow":value.pointer("/module_impact/state_flow"),
+        "capabilities":runtime.capabilities,"workflows":runtime.workflows,"authorization":runtime.policies,
+        "configuration":value.pointer("/module_impact/configuration"),"secrets":value.pointer("/module_impact/secrets"),
+        "modules":value.pointer("/module_impact/modules"),"ownership":value.pointer("/module_impact/ownership"),
+        "relationships":value.pointer("/module_impact/relationships"),"events":value.pointer("/module_impact/events"),
+        "seeded_records":seeded_records,"data_classification":"synthetic_preview","external_side_effects":"simulated","readiness":readiness
+    });
+    redact_inspection_value(&mut artifact);
+    insert_canonical(&state, PROPOSAL_PREVIEW_COLLECTION, artifact.get("preview_id").and_then(Value::as_str).unwrap_or(""), artifact.clone())?;
+    value["preview_id"] = artifact.get("preview_id").cloned().unwrap_or(Value::Null);
+    value["preview_expires_at"] = artifact.get("expires_at").cloned().unwrap_or(Value::Null);
+    let mut stored_proposal = if replacing_expired_preview {
+        let _ = put_canonical(&state, PROPOSAL_COLLECTION, &id, value.clone())?;
+        value
+    } else {
+        move_proposal(&state, &id, value, "previewed", &principal.key_id)?
+    };
+    redact_inspection_value(&mut stored_proposal);
+    if let Some(object) = artifact.as_object_mut() { object.remove("namespace"); }
+    artifact["proposal"] = stored_proposal;
+    Ok(Json(artifact))
+}
+
+async fn get_proposal_preview(
+    State(state): State<AppState>, Extension(principal): Extension<Principal>, Path(id): Path<String>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(&state, &principal.key_id, &input.application_id, "application:read")?;
+    let mut artifact = preview_artifact(&state, &id)?;
+    if !proposal_scope_matches(&artifact, &input.application_id, &input.environment) {
+        return Err(inspection_error(StatusCode::NOT_FOUND, "preview_not_found", "preview not found"));
+    }
+    if !preview_available(&artifact) {
+        return Err(inspection_error(StatusCode::GONE, "preview_expired", "preview artifact has expired"));
+    }
+    let proposal = proposal_value(&state, artifact.get("proposal_id").and_then(Value::as_str).unwrap_or(""))?;
+    if proposal.get("preview_id") != artifact.get("preview_id") {
+        return Err(inspection_error(StatusCode::CONFLICT, "preview_invalidated", "preview has been replaced"));
+    }
+    if proposal_readiness_value(&state, &tenant, &proposal)?.get("stale").and_then(Value::as_bool) == Some(true) {
+        return Err(inspection_error(StatusCode::CONFLICT, "preview_invalidated", "the application authority changed after preview creation"));
+    }
+    redact_inspection_value(&mut artifact);
+    if let Some(object) = artifact.as_object_mut() { object.remove("namespace"); }
+    Ok(Json(artifact))
+}
+
+async fn inspect_proposal_preview_data(
+    State(state): State<AppState>, Extension(principal): Extension<Principal>, Path((id, collection)): Path<(String, String)>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    application_scope(&state, &principal.key_id, &input.application_id, "application:read")?;
+    let artifact = preview_artifact(&state, &id)?;
+    if !proposal_scope_matches(&artifact, &input.application_id, &input.environment) {
+        return Err(inspection_error(StatusCode::NOT_FOUND, "preview_not_found", "preview not found"));
+    }
+    if !preview_available(&artifact) { return Err(inspection_error(StatusCode::GONE, "preview_expired", "preview artifact has expired")); }
+    if collection.starts_with("_feltdb") || !artifact.pointer("/proposed/schema").and_then(Value::as_array).is_some_and(|collections| collections.iter().any(|value| value.get("name").and_then(Value::as_str)==Some(&collection))) {
+        return Err(inspection_error(StatusCode::NOT_FOUND, "collection_not_found", "collection is not part of the proposed contract"));
+    }
+    let limit = input.limit.unwrap_or(DEFAULT_INSPECTION_LIMIT);
+    if limit == 0 || limit > MAX_INSPECTION_LIMIT { return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_pagination", format!("limit must be between 1 and {MAX_INSPECTION_LIMIT}"))); }
+    let state_version = state.db.sequence()?;
+    let filter_hash = format!("{id}:{collection}");
+    let after = input.cursor.as_deref().map(|cursor| parse_inspection_cursor(cursor, &filter_hash, state_version, "preview-data")).transpose()?;
+    let capability = format!("{}:{}", artifact.get("namespace").and_then(Value::as_str).unwrap_or(""), collection);
+    let mut rows = state.db.list_collection_page(&capability, after.as_deref(), limit.saturating_add(1))?;
+    let has_more = rows.len() > limit;
+    rows.truncate(limit);
+    let last_key = rows.last().map(|row| row.key.clone());
+    let mut records = rows.into_iter().map(|row| row.value).collect::<Vec<_>>();
+    for record in &mut records { redact_inspection_value(record); }
+    let next_cursor = if has_more { last_key.map(|key| inspection_cursor(&filter_hash, state_version, &key, "preview-data")) } else { None };
+    Ok(Json(json!({"preview_id":id,"collection":collection,"records":records,"data_classification":"synthetic_preview","pagination":{"limit":limit,"nextCursor":next_cursor}})))
+}
+
+async fn simulate_proposal_preview(
+    State(state): State<AppState>, Extension(principal): Extension<Principal>, Path(id): Path<String>,
+    Query(input): Query<ProposalScopeRequest>, Json(simulation): Json<PreviewSimulationRequest>,
+) -> Result<Json<Value>, ApiError> {
+    application_scope(&state, &principal.key_id, &input.application_id, "application:write")?;
+    let artifact = preview_artifact(&state, &id)?;
+    if !proposal_scope_matches(&artifact, &input.application_id, &input.environment) { return Err(inspection_error(StatusCode::NOT_FOUND, "preview_not_found", "preview not found")); }
+    if !preview_available(&artifact) { return Err(inspection_error(StatusCode::GONE, "preview_expired", "preview artifact has expired")); }
+    let known = artifact.get("events").and_then(Value::as_array).is_some_and(|events| events.iter().any(|event| event.as_str()==Some(&simulation.event)));
+    if !known { return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "unsupported_preview_event", "event is not part of the proposal")); }
+    let state_flow = artifact.get("state_flow").cloned().unwrap_or_else(||json!([]));
+    Ok(Json(json!({"preview_id":id,"event":simulation.event,"status":"simulated","external_side_effects":"none","trace":state_flow,"writes":"isolated_preview_namespace_only"})))
+}
+async fn transition_proposal(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(input): Json<ProposalStatusRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:write",
+    )?;
+    let mut value = proposal_value(&state, &id)?;
+    if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
+        return Err(ApiError(StatusCode::NOT_FOUND, "proposal not found".into()));
+    }
+    if !matches!(
+        input.status.as_str(),
+        "approved" | "rejected" | "expired" | "applied"
+    ) {
+        return Err(ApiError(
+            StatusCode::BAD_REQUEST,
+            "unsupported proposal status".into(),
+        ));
+    }
+    if proposal_is_expired(&value) && input.status != "expired" {
+        return Err(inspection_error(StatusCode::CONFLICT, "proposal_expired", "proposal has expired"));
+    }
+    if input.status == "approved" {
+        let readiness = proposal_readiness_value(&state, &tenant, &value)?;
+        if readiness.get("readiness").and_then(Value::as_str) != Some("ready") {
+            return Err(ApiError::structured(StatusCode::CONFLICT, json!({"code":"stale_proposal","message":"proposal is no longer applicable","readiness":readiness})));
+        }
+        let preview_id = value.get("preview_id").and_then(Value::as_str).ok_or_else(|| inspection_error(StatusCode::CONFLICT, "preview_required", "approval requires a ready preview artifact"))?;
+        let artifact = preview_artifact(&state, preview_id)?;
+        let bound = preview_available(&artifact)
+            && artifact.get("proposal_id").and_then(Value::as_str) == Some(id.as_str())
+            && artifact.get("proposal_contract_hash") == value.get("base_contract_hash")
+            && artifact.get("proposal_flow_hash") == value.get("base_flow_hash")
+            && artifact.get("module_versions") == value.get("module_versions");
+        if !bound { return Err(inspection_error(StatusCode::CONFLICT, "preview_invalid", "approval requires a current preview bound to this proposal")); }
+    }
+    if input.status == "applied" {
+        let configured = std::env::var("FELTDB_PROPOSAL_AUTHORITY_TOKEN").ok();
+        let supplied = headers.get("FeltDB-Proposal-Authority").and_then(|value| value.to_str().ok());
+        let repository_apply = headers.get("FeltDB-Repository-Apply").and_then(|value| value.to_str().ok()) == Some("1");
+        let authorized = configured.as_deref().zip(supplied).is_some_and(|(expected, actual)| expected.len() == actual.len() && ring::constant_time::verify_slices_are_equal(expected.as_bytes(), actual.as_bytes()).is_ok());
+        if !repository_apply || !authorized {
+            return Err(inspection_error(StatusCode::FORBIDDEN, "repository_authority_required", "valid repository application authority is required"));
+        }
+    }
+    if input.status == "approved"
+        && value
+            .get("warnings")
+            .and_then(Value::as_array)
+            .map(|items| {
+                items
+                    .iter()
+                    .any(|item| item.as_str().unwrap_or("").starts_with("Authorization "))
+            })
+            .unwrap_or(false)
+        && !input.approve_authorization
+    {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "AUTHORIZATION_APPROVAL_REQUIRED".into(),
+        ));
+    }
+    if input.status == "rejected" {
+        if let Some(reason) = input.reason { value["rejection_reason"] = json!(reason); }
+    }
+    let mut moved = move_proposal(
+        &state,
+        &id,
+        value,
+        &input.status,
+        &principal.key_id,
+    )?;
+    redact_inspection_value(&mut moved);
+    Ok(Json(moved))
+}
+
+async fn approve_proposal(
+    state: State<AppState>, principal: Extension<Principal>, headers: HeaderMap,
+    path: Path<String>, Json(input): Json<ProposalLifecycleRequest>,
+) -> Result<Json<Value>, ApiError> {
+    transition_proposal(state, principal, headers, path, Json(ProposalStatusRequest {
+        application_id: input.application_id, environment: input.environment, status: "approved".into(),
+        approve_authorization: input.approve_authorization, reason: input.reason,
+    })).await
+}
+
+async fn reject_proposal(
+    state: State<AppState>, principal: Extension<Principal>, headers: HeaderMap,
+    path: Path<String>, Json(input): Json<ProposalLifecycleRequest>,
+) -> Result<Json<Value>, ApiError> {
+    transition_proposal(state, principal, headers, path, Json(ProposalStatusRequest {
+        application_id: input.application_id, environment: input.environment, status: "rejected".into(),
+        approve_authorization: false, reason: input.reason,
+    })).await
+}
+fn auth_response(
+    identity: feltdb_server::identity::Identity,
+    session: feltdb_server::identity::IdentitySession,
+    token: String,
+) -> Json<Value> {
+    Json(json!({
+        "access_token": token,
+        "token_type": "Bearer",
+        "expires_at": session.expires_at,
+        "actor": { "user_id": identity.subject_id, "identity_id": identity.identity_id, "email": identity.email, "display_name": identity.display_name },
+        "session": { "session_id": session.session_id, "issued_at": session.issued_at, "expires_at": session.expires_at }
+    }))
+}
+async fn auth_sign_up(
+    State(state): State<AppState>,
+    Json(input): Json<SignUpRequest>,
+) -> Result<(StatusCode, Json<Value>), ApiError> {
+    if state
+        .tenancy
+        .application_tenant(&input.application_id)
+        .is_none()
+    {
+        return Err(ApiError(
+            StatusCode::NOT_FOUND,
+            "application not found".into(),
+        ));
     }
-    Ok(RuntimeInventory {
-        capabilities,
-        connections: connection_ids,
-        enforce_availability: true,
-    })
-}
-fn revision_contract(
-    state: &AppState,
-    actor: &str,
-    application_id: &str,
-    revision_id: &str,
-    environment: &str,
-) -> Result<ApplicationRuntimeContract, ApiError> {
-    let tenant = application_scope(state, actor, application_id, "application:revision:read")?;
-    let revision = state
-        .applications
-        .revision(&tenant, application_id, revision_id)
-        .ok_or(ApiError(StatusCode::NOT_FOUND, "revision not found".into()))?;
-    let inventory = runtime_inventory(state, actor, application_id, &revision.manifest)?;
-    resolve_runtime(&revision, environment, &inventory).map_err(|report| {
-        ApiError(
-            StatusCode::CONFLICT,
-            serde_json::to_string(&report).unwrap_or_else(|_| "runtime validation failed".into()),
+    let (identity, session, token) = state
+        .identities
+        .sign_up(&input.email, &input.password, input.display_name)
+        .map_err(|error| {
+            ApiError(
+                if error == "identity already exists" {
+                    StatusCode::CONFLICT
+                } else {
+                    StatusCode::BAD_REQUEST
+                },
+                error,
+            )
+        })?;
+    state
+        .tenancy
+        .register_platform_user(
+            &identity.subject_id,
+            identity.email.as_deref().unwrap_or(&identity.identity_id),
         )
-    })
+        .map_err(control_error)?;
+    state
+        .tenancy
+        .register_application_actor(&identity.subject_id, &input.application_id)
+        .map_err(control_error)?;
+    Ok((StatusCode::CREATED, auth_response(identity, session, token)))
 }
-async fn get_active_application_runtime(
+async fn auth_sign_in(
     State(state): State<AppState>,
-    Extension(principal): Extension<Principal>,
-    Path(application_id): Path<String>,
-    Query(input): Query<RuntimeEnvironmentRequest>,
+    Json(input): Json<SignInRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    let app = state
-        .tenancy
-        .application_for(&principal.key_id, &application_id)
-        .ok_or(ApiError(
-            StatusCode::NOT_FOUND,
-            "application not found".into(),
-        ))?;
-    let pointers = state.applications.pointers(&application_id);
-    let revision = pointers.get(&input.environment).ok_or(ApiError(
-        StatusCode::CONFLICT,
-        "application has no revision promoted to this environment".into(),
+    let (identity, session, token) = state
+        .identities
+        .sign_in(&input.email, &input.password)
+        .map_err(|_| ApiError(StatusCode::UNAUTHORIZED, "invalid credentials".into()))?;
+    Ok(auth_response(identity, session, token))
+}
+async fn auth_session(Extension(principal): Extension<Principal>) -> Json<Value> {
+    Json(
+        json!({ "actor": { "user_id": principal.key_id, "identity_id": principal.identity_id }, "session_id": principal.session_id }),
+    )
+}
+async fn auth_sign_out(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Result<StatusCode, ApiError> {
+    let session = principal.session_id.ok_or(ApiError(
+        StatusCode::BAD_REQUEST,
+        "request is not an actor session".into(),
     ))?;
-    let contract = revision_contract(
-        &state,
-        &principal.key_id,
-        &application_id,
-        revision,
-        &input.environment,
-    )?;
-    Ok(Json(
-        json!({"contract":contract,"runtime":state.runtimes.active(&app.tenant_id,&application_id,revision,&input.environment)}),
-    ))
+    state
+        .identities
+        .revoke_session(&principal.key_id, &session, "user_logout")
+        .map_err(control_error)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+async fn application_openapi() -> Json<Value> {
+    Json(json!({
+        "openapi": "3.1.0",
+        "info": { "title": "FeltDB Application Service", "version": "1.0.0" },
+        "servers": [{ "url": "/v1" }],
+        "components": {
+            "securitySchemes": { "bearer": { "type": "http", "scheme": "bearer" } },
+            "schemas": {
+                "Error": { "type": "object", "required": ["code", "message", "request_id"], "properties": {
+                    "code": { "type": "string" }, "message": { "type": "string" }, "request_id": { "type": "string" }
+                }},
+                "ApplicationEvent": { "type": "object", "required": ["event_id", "type", "resource", "resource_id", "actor", "timestamp", "payload"] }
+            }
+        },
+        "security": [{ "bearer": [] }],
+        "paths": {
+            "/health": { "get": { "security": [], "responses": { "200": { "description": "Runtime health" } } } },
+            "/application": { "get": { "responses": { "200": { "description": "Active application contract identity" } } } },
+            "/schema": { "get": { "responses": { "200": { "description": "Active application schema" } } } },
+            "/query": { "post": { "responses": { "200": { "description": "Bounded authorized query" } } } },
+            "/transactions": { "post": { "responses": { "200": { "description": "Atomic idempotent mutation" } } } },
+            "/events": { "get": { "responses": { "200": { "description": "Application event stream" } } } },
+            "/workflows/{name}/run": { "post": { "responses": { "201": { "description": "Workflow execution" } } } },
+            "/agents/{name}/run": { "post": { "responses": { "201": { "description": "Agent execution" } } } },
+            "/capabilities/{name}/run": { "post": { "responses": { "200": { "description": "Public capability result" } } } }
+        }
+    }))
 }
 async fn get_revision_runtime(
     State(state): State<AppState>,
@@ -4802,8 +6277,29 @@ async fn list_runtime_triggers(
     Ok(Json(json!(contract.triggers)))
 }
 
-fn state_policy_resource_matches(resource:&str,collection:&str)->bool{resource==collection||resource.strip_suffix('*').is_some_and(|prefix|!prefix.contains('*')&&collection.starts_with(prefix))}
-fn matching_state_policy<'a>(contract:&'a ApplicationRuntimeContract,collection:&str)->Option<&'a feltdb::application::PolicyDefinition>{contract.policies.definitions.iter().find(|p|p.resource==collection).or_else(||contract.policies.definitions.iter().find(|p|state_policy_resource_matches(&p.resource,collection)))}
+fn state_policy_resource_matches(resource: &str, collection: &str) -> bool {
+    resource == collection
+        || resource
+            .strip_suffix('*')
+            .is_some_and(|prefix| !prefix.contains('*') && collection.starts_with(prefix))
+}
+fn matching_state_policy<'a>(
+    contract: &'a ApplicationRuntimeContract,
+    collection: &str,
+) -> Option<&'a feltdb::application::PolicyDefinition> {
+    contract
+        .policies
+        .definitions
+        .iter()
+        .find(|p| p.resource == collection)
+        .or_else(|| {
+            contract
+                .policies
+                .definitions
+                .iter()
+                .find(|p| state_policy_resource_matches(&p.resource, collection))
+        })
+}
 fn authorize_transaction_collections(
     principal: &Principal,
     contract: &ApplicationRuntimeContract,
@@ -4836,14 +6332,14 @@ fn state_authorization(
 ) -> AuthorizationContext {
     let subject = format!("{}:{}", principal.subject_type, principal.key_id);
 
-    let policy=matching_state_policy(contract,collection);
+    let policy = matching_state_policy(contract, collection);
     let policy_subject = policy.and_then(|p| {
-            if operation == "read" {
-                p.read.as_ref().and_then(|s| PolicySubject::from_str(s))
-            } else {
-                p.write.as_ref().and_then(|s| PolicySubject::from_str(s))
-            }
-        });
+        if operation == "read" {
+            p.read.as_ref().and_then(|s| PolicySubject::from_str(s))
+        } else {
+            p.write.as_ref().and_then(|s| PolicySubject::from_str(s))
+        }
+    });
 
     // Evaluate policy if found
     let capabilities = if let Some(policy) = policy_subject {
@@ -4871,7 +6367,16 @@ fn state_authorization(
                 BTreeSet::new()
             }
         }
-    } else if policy.is_some_and(|p|p.capabilities.iter().any(|capability|capability==if operation=="read"{"state:read"}else{"state:write"})) {
+    } else if policy.is_some_and(|p| {
+        p.capabilities.iter().any(|capability| {
+            capability
+                == if operation == "read" {
+                    "state:read"
+                } else {
+                    "state:write"
+                }
+        })
+    }) {
         let capability = if operation == "read" {
             "state:read"
         } else {
@@ -5207,16 +6712,25 @@ async fn execute_canonical_transaction(
     input.transaction.revision_id = contract.revision_id.clone();
     input.transaction.schema_version = contract.state.schema.schema_version;
     input.transaction.state_namespace = Some(contract.environment.state_namespace.clone());
-    let collections = input.transaction.operations.iter()
+    let collections = input
+        .transaction
+        .operations
+        .iter()
         .map(|operation| operation.collection.clone())
         .collect::<Vec<_>>();
-    let (authorized, write_policies) = authorize_transaction_collections(
+    let (authorized, write_policies) =
+        authorize_transaction_collections(&principal, &contract, &tenant, &collections);
+    input.transaction.authorization = state_authorization_legacy(
         &principal,
-        &contract,
         &tenant,
-        &collections,
+        &input.application_id,
+        &contract.revision_id,
+        if authorized {
+            "state:write"
+        } else {
+            "state:denied"
+        },
     );
-    input.transaction.authorization=state_authorization_legacy(&principal,&tenant,&input.application_id,&contract.revision_id,if authorized{"state:write"}else{"state:denied"});
     let result = execute_transaction_with_collection_policies(
         &state.db,
         &contract.state.schema,
@@ -6029,6 +7543,51 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             axum::routing::post(validate_state_schema),
         )
         .route("/v1/schema", get(get_state_schema))
+        .route("/v1/application", get(discover_application))
+        .route("/v1/application/schema", get(inspect_application_schema))
+        .route("/v1/data/{collection}", get(inspect_collection))
+        .route("/v1/data/{collection}/{id}", get(inspect_record))
+        .route("/v1/proposals", get(list_proposals).post(create_proposal))
+        .route("/v1/proposals/{id}", get(get_proposal))
+        .route("/v1/proposals/{id}/history", get(proposal_history))
+        .route(
+            "/v1/proposals/{id}/validate",
+            axum::routing::post(validate_proposal),
+        )
+        .route(
+            "/v1/proposals/{id}/preview",
+            axum::routing::post(preview_proposal),
+        )
+        .route(
+            "/v1/proposals/{id}/approve",
+            axum::routing::post(approve_proposal),
+        )
+        .route(
+            "/v1/proposals/{id}/reject",
+            axum::routing::post(reject_proposal),
+        )
+        .route(
+            "/v1/proposals/{id}/status",
+            get(proposal_status).patch(transition_proposal),
+        )
+        .route("/v1/previews/{id}", get(get_proposal_preview))
+        .route("/v1/previews/{id}/data/{collection}", get(inspect_proposal_preview_data))
+        .route("/v1/previews/{id}/simulate", axum::routing::post(simulate_proposal_preview))
+        .route("/v1/auth/session", get(auth_session))
+        .route("/v1/auth/signout", axum::routing::post(auth_sign_out))
+        .route("/v1/events", get(events))
+        .route(
+            "/v1/workflows/{name}/run",
+            axum::routing::post(start_workflow_run),
+        )
+        .route(
+            "/v1/agents/{name}/run",
+            axum::routing::post(start_agent_run),
+        )
+        .route(
+            "/v1/capabilities/{name}/run",
+            axum::routing::post(execute_application_capability),
+        )
         .route("/v1/state/version", get(get_state_version))
         .route("/v1/query", axum::routing::post(execute_canonical_query))
         .route(
@@ -6393,6 +7952,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     let mut app = Router::new()
         .route("/health", get(health))
+        .route("/v1/health", get(health))
+        .route("/v1/openapi.json", get(application_openapi))
+        .route("/v1/auth/signup", axum::routing::post(auth_sign_up))
+        .route("/v1/auth/signin", axum::routing::post(auth_sign_in))
         .route("/ready", get(readiness))
         .route("/runtime", get(runtime))
         .route("/metrics", get(network_metrics))
@@ -6422,6 +7985,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                     axum::http::header::CONTENT_TYPE,
                     axum::http::HeaderName::from_static("feltdb-protocol"),
                     axum::http::HeaderName::from_static("if-version"),
+                    axum::http::HeaderName::from_static("idempotency-key"),
                 ]),
         );
     }
@@ -6472,6 +8036,7 @@ async fn authenticate(
             .and_then(|header| header.to_str().ok())
             .and_then(|header| header.strip_prefix("Bearer "));
         let machine = token.and_then(|token| state.keys.authenticate(token, &state.namespace));
+        let actor = token.and_then(|token| state.identities.authenticate_session(token));
         let human = request
             .headers()
             .get(COOKIE)
@@ -6483,9 +8048,25 @@ async fn authenticate(
                     .find_map(|cookie| cookie.strip_prefix("feltdb_session="))
             })
             .and_then(|token| state.sessions.verify(token));
-        match (machine, human) {
-            (Some(principal), _) => principal,
-            (None, Some(session)) => {
+        match (machine, actor, human) {
+            (Some(principal), _, _) => principal,
+            (None, Some(session), _) => Principal {
+                key_id: session.subject_id,
+                scopes: vec![
+                    "application:read".into(),
+                    "application:revision:read".into(),
+                    "state:read".into(),
+                    "state:write".into(),
+                    "events:read".into(),
+                    "workflows:run".into(),
+                    "agents:run".into(),
+                    "capabilities:run".into(),
+                ],
+                subject_type: "human".into(),
+                identity_id: Some(session.identity_id),
+                session_id: Some(session.session_id),
+            },
+            (None, None, Some(session)) => {
                 if state
                     .tenancy
                     .register_platform_user(&session.user_id, &session.identity)
@@ -6503,7 +8084,7 @@ async fn authenticate(
                     session_id: Some(session.id),
                 }
             }
-            (None, None) => {
+            (None, None, None) => {
                 state.metrics.authentication_failure();
                 audit(
                     &state,
@@ -6711,9 +8292,7 @@ async fn health(State(state): State<AppState>) -> Json<HealthResponse<'static>>
     })
 }
 
-async fn managed_diagnostics(
-    State(state): State<AppState>,
-) -> Json<ManagedDiagnosticsResponse> {
+async fn managed_diagnostics(State(state): State<AppState>) -> Json<ManagedDiagnosticsResponse> {
     let recovery = match state.cluster.proposal().map(|value| value.phase) {
         Some(ProposalPhase::Preparing | ProposalPhase::Prepared) => "recovering",
         Some(ProposalPhase::Aborted) => "attention-required",
@@ -6730,8 +8309,7 @@ async fn managed_diagnostics(
         storage_format: 1,
         promoted_revision: std::env::var("FELTDB_PROMOTED_REVISION")
             .unwrap_or_else(|_| "unknown".into()),
-        environment: std::env::var("FELTDB_ENVIRONMENT")
-            .unwrap_or_else(|_| "development".into()),
+        environment: std::env::var("FELTDB_ENVIRONMENT").unwrap_or_else(|_| "development".into()),
         recovery: recovery.into(),
         uptime: format!("{uptime_seconds}s"),
     })
@@ -8476,13 +10054,67 @@ async fn define_capability(
 
 async fn execute_capability(
     State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
     Path(name): Path<String>,
     Json(input): Json<Value>,
 ) -> Result<Json<Value>, ApiError> {
+    if !principal.permits("capabilities:run") {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "capability execution is not permitted".into(),
+        ));
+    }
     validate_segment(&name)?;
     Ok(Json(execute_named_capability(&state, &name, &input)?))
 }
 
+async fn execute_application_capability(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(name): Path<String>,
+    Query(input): Query<ApplicationDiscoveryRequest>,
+    Json(payload): Json<Value>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "capabilities:run",
+    )?;
+    let revision_id = state
+        .applications
+        .pointers(&input.application_id)
+        .get(&input.environment)
+        .cloned()
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application environment has no active contract".into(),
+        ))?;
+    let revision = state
+        .applications
+        .revision(&tenant, &input.application_id, &revision_id)
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application revision not found".into(),
+        ))?;
+    let capability = revision
+        .manifest
+        .capabilities
+        .iter()
+        .find(|value| value.name == name)
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "capability not found".into(),
+        ))?;
+    if capability.visibility != "public" {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "capability is not externally invocable".into(),
+        ));
+    }
+    Ok(Json(execute_named_capability(&state, &name, &payload)?))
+}
+
 fn validate_capability_program(program: &CapabilityProgram) -> Result<(), ApiError> {
     if program.steps.is_empty() || program.steps.len() > 16 {
         return Err(ApiError(
@@ -8668,9 +10300,16 @@ async fn define_workflow(
 
 async fn start_workflow_run(
     State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
     Path(name): Path<String>,
     Json(request): Json<StartRun>,
 ) -> Result<(StatusCode, Json<RecordResponse>), ApiError> {
+    if !principal.permits("workflows:run") {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "workflow execution is not permitted".into(),
+        ));
+    }
     validate_segment(&name)?;
     let definition = required_value(&state, "_flow_workflows", &name, "workflow not found")?;
     let steps = definition["steps"].as_array().ok_or_else(|| {
@@ -8828,9 +10467,16 @@ async fn define_agent(
 
 async fn start_agent_run(
     State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
     Path(name): Path<String>,
     Json(request): Json<StartAgentRun>,
 ) -> Result<(StatusCode, Json<RecordResponse>), ApiError> {
+    if !principal.permits("agents:run") {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "agent execution is not permitted".into(),
+        ));
+    }
     validate_segment(&name)?;
     required_value(&state, "_flow_agents", &name, "agent not found")?;
     if request.goal.trim().is_empty() {
@@ -9052,10 +10698,13 @@ struct BoundedQueryPage {
 }
 
 fn bounded_query_error(code: &str, message: impl Into<String>) -> ApiError {
-    ApiError::structured(StatusCode::UNPROCESSABLE_ENTITY, json!({
-        "code": code,
-        "message": message.into(),
-    }))
+    ApiError::structured(
+        StatusCode::UNPROCESSABLE_ENTITY,
+        json!({
+            "code": code,
+            "message": message.into(),
+        }),
+    )
 }
 
 fn bounded_query_hash(request: &BoundedQueryRequest) -> Result<String, ApiError> {
@@ -9078,7 +10727,10 @@ fn query_scalar_cmp(left: Option<&Value>, right: Option<&Value>) -> std::cmp::Or
         (Some(Value::Null), Some(Value::Null)) => std::cmp::Ordering::Equal,
         (Some(Value::Null), Some(_)) => std::cmp::Ordering::Less,
         (Some(_), Some(Value::Null)) => std::cmp::Ordering::Greater,
-        (Some(Value::Number(a)), Some(Value::Number(b))) => a.as_f64().partial_cmp(&b.as_f64()).unwrap_or(std::cmp::Ordering::Equal),
+        (Some(Value::Number(a)), Some(Value::Number(b))) => a
+            .as_f64()
+            .partial_cmp(&b.as_f64())
+            .unwrap_or(std::cmp::Ordering::Equal),
         (Some(Value::String(a)), Some(Value::String(b))) => a.cmp(b),
         (Some(Value::Bool(a)), Some(Value::Bool(b))) => a.cmp(b),
         (Some(a), Some(b)) => a.to_string().cmp(&b.to_string()),
@@ -9087,31 +10739,60 @@ fn query_scalar_cmp(left: Option<&Value>, right: Option<&Value>) -> std::cmp::Or
 
 fn condition_matches(record: &Value, condition: &BoundedQueryCondition) -> Result<bool, ApiError> {
     if condition.operators.len() != 1 || condition.field.trim().is_empty() {
-        return Err(bounded_query_error("INVALID_QUERY", "each where condition requires a field and exactly one operator"));
+        return Err(bounded_query_error(
+            "INVALID_QUERY",
+            "each where condition requires a field and exactly one operator",
+        ));
     }
-    let (operator, expected) = condition.operators.iter().next().expect("validated operator");
+    let (operator, expected) = condition
+        .operators
+        .iter()
+        .next()
+        .expect("validated operator");
     let actual = record.get(&condition.field);
-    if operator == "eq" { return Ok(actual == Some(expected)); }
-    if operator == "neq" { return Ok(actual != Some(expected)); }
-    let Some(actual) = actual else { return Ok(false) };
+    if operator == "eq" {
+        return Ok(actual == Some(expected));
+    }
+    if operator == "neq" {
+        return Ok(actual != Some(expected));
+    }
+    let Some(actual) = actual else {
+        return Ok(false);
+    };
     let comparison = query_scalar_cmp(Some(actual), Some(expected));
     Ok(match operator.as_str() {
         "lt" => comparison.is_lt(),
         "lte" => !comparison.is_gt(),
         "gt" => comparison.is_gt(),
         "gte" => !comparison.is_lt(),
-        _ => return Err(bounded_query_error("INVALID_QUERY", format!("unsupported where operator: {operator}"))),
+        _ => {
+            return Err(bounded_query_error(
+                "INVALID_QUERY",
+                format!("unsupported where operator: {operator}"),
+            ))
+        }
     })
 }
 
-fn issue_bounded_cursor(state: &AppState, mut cursor: BoundedQueryCursor) -> Result<String, ApiError> {
+fn issue_bounded_cursor(
+    state: &AppState,
+    mut cursor: BoundedQueryCursor,
+) -> Result<String, ApiError> {
     let token = uuid::Uuid::new_v4().simple().to_string();
     let now = unix_seconds_i64().max(0) as u64;
     cursor.created_at = now;
-    let mut cursors = state.bounded_query_cursors.lock().map_err(|_| ApiError(StatusCode::INTERNAL_SERVER_ERROR, "query cursor store unavailable".into()))?;
+    let mut cursors = state.bounded_query_cursors.lock().map_err(|_| {
+        ApiError(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "query cursor store unavailable".into(),
+        )
+    })?;
     cursors.retain(|_, value| now.saturating_sub(value.created_at) <= BOUNDED_CURSOR_TTL_SECONDS);
     if cursors.len() >= 1024 {
-        return Err(ApiError(StatusCode::SERVICE_UNAVAILABLE, "query cursor capacity exhausted".into()));
+        return Err(ApiError(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "query cursor capacity exhausted".into(),
+        ));
     }
     cursors.insert(token.clone(), cursor);
     Ok(token)
@@ -9124,32 +10805,67 @@ async fn execute_bounded_query(
 ) -> Result<Json<BoundedQueryPage>, ApiError> {
     validate_segment(&request.collection)?;
     if request.limit == 0 || request.limit > MAX_BOUNDED_QUERY_LIMIT {
-        return Err(bounded_query_error("INVALID_QUERY", format!("limit must be between 1 and {MAX_BOUNDED_QUERY_LIMIT}")));
+        return Err(bounded_query_error(
+            "INVALID_QUERY",
+            format!("limit must be between 1 and {MAX_BOUNDED_QUERY_LIMIT}"),
+        ));
     }
     if request.order_by.is_empty() {
-        return Err(bounded_query_error("INVALID_QUERY", "orderBy must contain at least one field"));
+        return Err(bounded_query_error(
+            "INVALID_QUERY",
+            "orderBy must contain at least one field",
+        ));
     }
     for order in &request.order_by {
         if order.field.trim().is_empty() || !matches!(order.direction.as_str(), "asc" | "desc") {
-            return Err(bounded_query_error("INVALID_QUERY", "orderBy directions must be asc or desc"));
+            return Err(bounded_query_error(
+                "INVALID_QUERY",
+                "orderBy directions must be asc or desc",
+            ));
         }
     }
     for condition in &request.conditions {
-        if condition.operators.len() != 1 || condition.field.trim().is_empty()
-            || !condition.operators.keys().all(|operator| matches!(operator.as_str(), "eq" | "neq" | "lt" | "lte" | "gt" | "gte")) {
-            return Err(bounded_query_error("INVALID_QUERY", "each where condition requires a field and exactly one operator"));
+        if condition.operators.len() != 1
+            || condition.field.trim().is_empty()
+            || !condition.operators.keys().all(|operator| {
+                matches!(
+                    operator.as_str(),
+                    "eq" | "neq" | "lt" | "lte" | "gt" | "gte"
+                )
+            })
+        {
+            return Err(bounded_query_error(
+                "INVALID_QUERY",
+                "each where condition requires a field and exactly one operator",
+            ));
         }
     }
     let hash = bounded_query_hash(&request)?;
     let (records, position) = if let Some(token) = &request.cursor {
-        let cursor = state.bounded_query_cursors.lock()
-            .map_err(|_| ApiError(StatusCode::INTERNAL_SERVER_ERROR, "query cursor store unavailable".into()))?
-            .get(token).cloned()
+        let cursor = state
+            .bounded_query_cursors
+            .lock()
+            .map_err(|_| {
+                ApiError(
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    "query cursor store unavailable".into(),
+                )
+            })?
+            .get(token)
+            .cloned()
             .ok_or_else(|| bounded_query_error("INVALID_CURSOR", "cursor is invalid or expired"))?;
-        if cursor.query_hash != hash || cursor.principal_key_id != principal.key_id || cursor.namespace != state.namespace.as_ref() {
-            return Err(bounded_query_error("INVALID_CURSOR", "cursor does not match this query, principal, or namespace"));
+        if cursor.query_hash != hash
+            || cursor.principal_key_id != principal.key_id
+            || cursor.namespace != state.namespace.as_ref()
+        {
+            return Err(bounded_query_error(
+                "INVALID_CURSOR",
+                "cursor does not match this query, principal, or namespace",
+            ));
         }
-        if (unix_seconds_i64().max(0) as u64).saturating_sub(cursor.created_at) > BOUNDED_CURSOR_TTL_SECONDS {
+        if (unix_seconds_i64().max(0) as u64).saturating_sub(cursor.created_at)
+            > BOUNDED_CURSOR_TTL_SECONDS
+        {
             return Err(bounded_query_error("INVALID_CURSOR", "cursor is expired"));
         }
         (cursor.records, cursor.position)
@@ -9158,13 +10874,21 @@ async fn execute_bounded_query(
         for row in state.db.list_collection(&request.collection)? {
             let mut value = row.value;
             if let Some(object) = value.as_object_mut() {
-                let id = row.key.split_once(':').map(|(_, id)| id).unwrap_or(&row.key);
+                let id = row
+                    .key
+                    .split_once(':')
+                    .map(|(_, id)| id)
+                    .unwrap_or(&row.key);
                 // `recordId` is authority metadata for this query surface, not
                 // caller-controlled document data. It is the final total-order
                 // tie-breaker even when a document contains a field by that name.
                 object.insert("recordId".into(), Value::String(id.to_string()));
             }
-            if request.conditions.iter().all(|condition| condition_matches(&value, condition).unwrap_or(false)) {
+            if request
+                .conditions
+                .iter()
+                .all(|condition| condition_matches(&value, condition).unwrap_or(false))
+            {
                 records.push(value);
             }
         }
@@ -9173,7 +10897,13 @@ async fn execute_bounded_query(
         records.sort_by(|left, right| {
             for order in &request.order_by {
                 let comparison = query_scalar_cmp(left.get(&order.field), right.get(&order.field));
-                if !comparison.is_eq() { return if order.direction == "desc" { comparison.reverse() } else { comparison }; }
+                if !comparison.is_eq() {
+                    return if order.direction == "desc" {
+                        comparison.reverse()
+                    } else {
+                        comparison
+                    };
+                }
             }
             query_scalar_cmp(left.get("recordId"), right.get("recordId"))
         });
@@ -9182,22 +10912,37 @@ async fn execute_bounded_query(
     let end = position.saturating_add(request.limit).min(records.len());
     let page = records[position.min(records.len())..end].to_vec();
     let next_cursor = if end < records.len() {
-        Some(issue_bounded_cursor(&state, BoundedQueryCursor {
-            query_hash: hash,
-            principal_key_id: principal.key_id,
-            namespace: state.namespace.to_string(),
-            records: records.clone(),
-            position: end,
-            created_at: 0,
-        })?)
-    } else { None };
-    Ok(Json(BoundedQueryPage { records: page, exhausted: next_cursor.is_none(), next_cursor }))
+        Some(issue_bounded_cursor(
+            &state,
+            BoundedQueryCursor {
+                query_hash: hash,
+                principal_key_id: principal.key_id,
+                namespace: state.namespace.to_string(),
+                records: records.clone(),
+                position: end,
+                created_at: 0,
+            },
+        )?)
+    } else {
+        None
+    };
+    Ok(Json(BoundedQueryPage {
+        records: page,
+        exhausted: next_cursor.is_none(),
+        next_cursor,
+    }))
 }
 
 async fn list_records(
     State(state): State<AppState>,
     Path(collection): Path<String>,
 ) -> Result<Json<Vec<RecordResponse>>, ApiError> {
+    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "system collection requires proposal service".into(),
+        ));
+    }
     validate_segment(&collection)?;
     let rows = state.db.list_collection(&collection)?;
     Ok(Json(rows.into_iter().map(record_response).collect()))
@@ -9207,6 +10952,12 @@ async fn get_record(
     State(state): State<AppState>,
     Path((collection, id)): Path<(String, String)>,
 ) -> Result<Json<RecordResponse>, ApiError> {
+    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "system collection requires proposal service".into(),
+        ));
+    }
     let key = record_key(&collection, &id)?;
     let value = state
         .db
@@ -9427,7 +11178,11 @@ async fn commit_transaction(
         })?;
 
     Ok((
-        if commit.duplicate { StatusCode::OK } else { StatusCode::CREATED },
+        if commit.duplicate {
+            StatusCode::OK
+        } else {
+            StatusCode::CREATED
+        },
         Json(AtomicTxResponse {
             transaction_id: commit.transaction_id,
             duplicate: commit.duplicate,
@@ -9443,6 +11198,12 @@ async fn create_record(
     Path(collection): Path<String>,
     Json(mut record): Json<CreateRecord>,
 ) -> Result<(StatusCode, Json<RecordResponse>), ApiError> {
+    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "system collection requires proposal service".into(),
+        ));
+    }
     validate_segment(&collection)?;
     let id = record
         .id
@@ -9476,6 +11237,12 @@ async fn update_record(
     Path((collection, id)): Path<(String, String)>,
     Json(changes): Json<Map<String, Value>>,
 ) -> Result<Json<RecordResponse>, ApiError> {
+    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "system collection requires proposal service".into(),
+        ));
+    }
     let key = record_key(&collection, &id)?;
     let current = state
         .db
@@ -9591,6 +11358,12 @@ async fn delete_record(
     State(state): State<AppState>,
     Path((collection, id)): Path<(String, String)>,
 ) -> Result<StatusCode, ApiError> {
+    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "system collection requires proposal service".into(),
+        ));
+    }
     let key = record_key(&collection, &id)?;
     if state.db.get_value(&key)?.is_none() {
         return Err(ApiError(
@@ -9604,14 +11377,36 @@ async fn delete_record(
 
 async fn events(
     State(state): State<AppState>,
-) -> Sse<impl futures_core::Stream<Item = Result<Event, Infallible>>> {
+    Extension(principal): Extension<Principal>,
+    Query(scope): Query<EventScopeRequest>,
+) -> Result<Sse<impl futures_core::Stream<Item = Result<Event, Infallible>>>, ApiError> {
+    if !principal.permits("events:read") {
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            "event access is not permitted".into(),
+        ));
+    }
+    if let Some(application_id) = scope.application_id {
+        application_scope(&state, &principal.key_id, &application_id, "events:read")?;
+    }
     let mut receiver = state.db.subscribe_changes();
     let namespace = state.namespace.clone();
+    let actor = principal.key_id;
     let stream = async_stream::stream! {
         loop {
             match receiver.recv().await {
                 Ok(change) => {
-                    let data = json!({ "namespace": namespace.as_ref(), "type": "state.changed", "change": change });
+                    let resource = change.capability.clone();
+                    let resource_id = change.key.split_once(':').map(|(_, id)| id).unwrap_or(&change.key);
+                    let data = json!({
+                        "event_id": uuid::Uuid::new_v4().to_string(),
+                        "type": "state.changed",
+                        "resource": resource,
+                        "resource_id": resource_id,
+                        "actor": actor,
+                        "timestamp": unix_seconds_i64().max(0) as u64,
+                        "payload": { "operation": "mutation", "namespace": namespace.as_ref() }
+                    });
                     yield Ok(Event::default().event("state.changed").json_data(data).expect("serializable event"));
                 }
                 Err(tokio::sync::broadcast::error::RecvError::Lagged(skipped)) => {
@@ -9621,7 +11416,7 @@ async fn events(
             }
         }
     };
-    Sse::new(stream).keep_alive(KeepAlive::new().interval(Duration::from_secs(15)))
+    Ok(Sse::new(stream).keep_alive(KeepAlive::new().interval(Duration::from_secs(15))))
 }
 
 fn record_response(row: StoredRow) -> RecordResponse {
@@ -9683,7 +11478,10 @@ mod authority_gate_tests {
     use super::{api_error_body, authorize_transaction_collections, state_authorization};
     use axum::http::StatusCode;
     use feltdb::{
-        application::{manifest_hash, ApplicationManifest, ApplicationRevision, PolicyDefinition, RevisionStatus},
+        application::{
+            manifest_hash, ApplicationManifest, ApplicationRevision, PolicyDefinition,
+            RevisionStatus,
+        },
         application_runtime::{resolve_runtime, ApplicationRuntimeContract, RuntimeInventory},
     };
     use feltdb_server::auth::Principal;
@@ -9729,9 +11527,16 @@ mod authority_gate_tests {
     #[test]
     fn no_matching_policy_denies() {
         let contract = contract(vec![]);
-        assert!(state_authorization(&principal(), &contract, "secrets", "read").capabilities.is_empty());
+        assert!(
+            state_authorization(&principal(), &contract, "secrets", "read")
+                .capabilities
+                .is_empty()
+        );
         let (allowed, _) = authorize_transaction_collections(
-            &principal(), &contract, "tenant", &["secrets".into()],
+            &principal(),
+            &contract,
+            "tenant",
+            &["secrets".into()],
         );
         assert!(!allowed);
     }
@@ -9740,7 +11545,10 @@ mod authority_gate_tests {
     fn terminal_wildcard_policy_allows_matching_collection() {
         let contract = contract(vec![allow("buzz_*")]);
         let (allowed, _) = authorize_transaction_collections(
-            &principal(), &contract, "tenant", &["buzz_rooms".into()],
+            &principal(),
+            &contract,
+            "tenant",
+            &["buzz_rooms".into()],
         );
         assert!(allowed);
     }
@@ -9749,10 +11557,16 @@ mod authority_gate_tests {
     fn multi_collection_transaction_authorizes_every_operation() {
         let contract = contract(vec![allow("alpha"), allow("beta")]);
         let (all_allowed, _) = authorize_transaction_collections(
-            &principal(), &contract, "tenant", &["alpha".into(), "beta".into()],
+            &principal(),
+            &contract,
+            "tenant",
+            &["alpha".into(), "beta".into()],
         );
         let (mixed_allowed, _) = authorize_transaction_collections(
-            &principal(), &contract, "tenant", &["alpha".into(), "secrets".into()],
+            &principal(),
+            &contract,
+            "tenant",
+            &["alpha".into(), "secrets".into()],
         );
         assert!(all_allowed);
         assert!(!mixed_allowed);
@@ -9762,7 +11576,10 @@ mod authority_gate_tests {
     fn cross_tenant_transaction_denies() {
         let contract = contract(vec![allow("alpha")]);
         let (allowed, _) = authorize_transaction_collections(
-            &principal(), &contract, "other-tenant", &["alpha".into()],
+            &principal(),
+            &contract,
+            "other-tenant",
+            &["alpha".into()],
         );
         assert!(!allowed);
     }
@@ -9775,10 +11592,10 @@ mod authority_gate_tests {
             "missing scope: state:read",
             r#"{"code":"AUTHORIZATION_DENIED","message":"policy denied"}"#,
         ] {
-            assert_eq!(
-                api_error_body(StatusCode::FORBIDDEN, internal_message.into()),
-                serde_json::json!({ "error": "AUTHORIZATION_DENIED" })
-            );
+            let body = api_error_body(StatusCode::FORBIDDEN, internal_message.into());
+            assert_eq!(body["error"], "FORBIDDEN");
+            assert_eq!(body["code"], "FORBIDDEN");
+            assert!(body["request_id"].as_str().unwrap().starts_with("req_"));
         }
     }
 }