npm - @rathnasgala2/schemas - Versions diffs - 3.5.0 → 3.7.0 - Mend

@rathnasgala2/schemas 3.5.0 → 3.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/THIRD_PARTY_LICENSES.json +1 -1
package/docs/catalogs/app-components.json +1766 -2
package/docs/catalogs/app-routes.json +598 -1
package/docs/catalogs/schema-inventory.json +2 -2
package/openapi/http-catalog.json +170 -2
package/openapi/openapi.yaml +2840 -144
package/package.json +1 -1
package/sbom.cdx.json +23 -23

package/openapi/openapi.yaml CHANGED Viewed

@@ -141,6 +141,224 @@ components:
         minLength: 32
         type: string
   responses:
+    AuthorizationDenied:
+      content:
+        application/problem+json:
+          examples:
+            AUTHORIZATION_DENIED:
+              summary: AUTHORIZATION_DENIED
+              value:
+                code: AUTHORIZATION_DENIED
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 403
+                title: AUTHORIZATION_DENIED
+                type: urn:gala:problem:authorization-denied
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: AUTHORIZATION_DENIED
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - AUTHORIZATION_DENIED
+    CommandReplayConflict:
+      content:
+        application/problem+json:
+          examples:
+            COMMAND_REPLAY_CONFLICT:
+              summary: COMMAND_REPLAY_CONFLICT
+              value:
+                code: COMMAND_REPLAY_CONFLICT
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: COMMAND_REPLAY_CONFLICT
+                type: urn:gala:problem:command-replay-conflict
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: COMMAND_REPLAY_CONFLICT
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - COMMAND_REPLAY_CONFLICT
+    InvalidDecisionCommandConflict:
+      content:
+        application/problem+json:
+          examples:
+            COMMAND_REPLAY_CONFLICT:
+              summary: COMMAND_REPLAY_CONFLICT
+              value:
+                code: COMMAND_REPLAY_CONFLICT
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: COMMAND_REPLAY_CONFLICT
+                type: urn:gala:problem:command-replay-conflict
+            INVALID_DECISION:
+              summary: INVALID_DECISION
+              value:
+                code: INVALID_DECISION
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: INVALID_DECISION
+                type: urn:gala:problem:invalid-decision
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: COMMAND_REPLAY_CONFLICT, INVALID_DECISION
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - COMMAND_REPLAY_CONFLICT
+        - INVALID_DECISION
+    InvalidSourceStateCommandConflict:
+      content:
+        application/problem+json:
+          examples:
+            COMMAND_REPLAY_CONFLICT:
+              summary: COMMAND_REPLAY_CONFLICT
+              value:
+                code: COMMAND_REPLAY_CONFLICT
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: COMMAND_REPLAY_CONFLICT
+                type: urn:gala:problem:command-replay-conflict
+            INVALID_SOURCE_STATE:
+              summary: INVALID_SOURCE_STATE
+              value:
+                code: INVALID_SOURCE_STATE
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: INVALID_SOURCE_STATE
+                type: urn:gala:problem:invalid-source-state
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: COMMAND_REPLAY_CONFLICT, INVALID_SOURCE_STATE
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - COMMAND_REPLAY_CONFLICT
+        - INVALID_SOURCE_STATE
+    PlatformAuthenticationRequired:
+      content:
+        application/problem+json:
+          examples:
+            AUTHENTICATION_REQUIRED:
+              summary: AUTHENTICATION_REQUIRED
+              value:
+                code: AUTHENTICATION_REQUIRED
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 401
+                title: AUTHENTICATION_REQUIRED
+                type: urn:gala:problem:authentication-required
+            REAUTH_REQUIRED:
+              summary: REAUTH_REQUIRED
+              value:
+                code: REAUTH_REQUIRED
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 401
+                title: REAUTH_REQUIRED
+                type: urn:gala:problem:reauth-required
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: AUTHENTICATION_REQUIRED, REAUTH_REQUIRED
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - AUTHENTICATION_REQUIRED
+        - REAUTH_REQUIRED
+    RequestInvalid:
+      content:
+        application/problem+json:
+          examples:
+            REQUEST_FIELD_UNKNOWN:
+              summary: REQUEST_FIELD_UNKNOWN
+              value:
+                code: REQUEST_FIELD_UNKNOWN
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 400
+                title: REQUEST_FIELD_UNKNOWN
+                type: urn:gala:problem:request-field-unknown
+            VALIDATION_FAILED:
+              summary: VALIDATION_FAILED
+              value:
+                code: VALIDATION_FAILED
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 400
+                title: VALIDATION_FAILED
+                type: urn:gala:problem:validation-failed
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: REQUEST_FIELD_UNKNOWN, VALIDATION_FAILED
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - REQUEST_FIELD_UNKNOWN
+        - VALIDATION_FAILED
     RequestTooLarge:
       content:
         application/problem+json:
@@ -168,6 +386,60 @@ components:
           $ref: "#/components/headers/XCorrelationId"
       x-gala-problem-codes:
         - VALIDATION_FAILED
+    ResourceNotFound:
+      content:
+        application/problem+json:
+          examples:
+            RESOURCE_NOT_FOUND:
+              summary: RESOURCE_NOT_FOUND
+              value:
+                code: RESOURCE_NOT_FOUND
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 404
+                title: RESOURCE_NOT_FOUND
+                type: urn:gala:problem:resource-not-found
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: RESOURCE_NOT_FOUND
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - RESOURCE_NOT_FOUND
+    StaleAggregateVersion:
+      content:
+        application/problem+json:
+          examples:
+            STALE_AGGREGATE_VERSION:
+              summary: STALE_AGGREGATE_VERSION
+              value:
+                code: STALE_AGGREGATE_VERSION
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 412
+                title: STALE_AGGREGATE_VERSION
+                type: urn:gala:problem:stale-aggregate-version
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: STALE_AGGREGATE_VERSION
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - STALE_AGGREGATE_VERSION
     UnsupportedMediaType:
       content:
         application/problem+json:
@@ -1358,18 +1630,20 @@ components:
         - EXPIRED
       type: string
     DnsIntent:
-      description: "`ADD` writes the domain's records at the provider; `REMOVE` deletes only the records whose values are Galascribe's targets, never anything else at that name."
+      description: "`ADD` writes the domain's records at the provider; `REMOVE` deletes only the records whose values are Galascribe's targets, never anything else at that name; `PROXY` (SCHEMA-3.6.0) turns the provider's proxy on for exactly the records Galascribe wrote, and is offered only once the domain is live with an issued certificate."
       enum:
         - ADD
         - REMOVE
+        - PROXY
       type: string
     DnsPlanAction:
-      description: "`CREATE` a record that is not there; `KEEP` one already identical; `REPLACE` one of the same type, or a CNAME where an A/AAAA must go (or the reverse), that differs; `DELETE` a record carrying a Galascribe target value (`REMOVE` only)."
+      description: "`CREATE` a record that is not there; `KEEP` one already identical; `REPLACE` one of the same type, or a CNAME where an A/AAAA must go (or the reverse), that differs; `DELETE` a record carrying a Galascribe target value (`REMOVE` only); `PROXY_ON` (SCHEMA-3.6.0, `PROXY` only) the record exists DNS-only and will be set to proxied."
       enum:
         - CREATE
         - KEEP
         - REPLACE
         - DELETE
+        - PROXY_ON
       type: string
     DnsPlanEntry:
       additionalProperties: false
@@ -1414,7 +1688,7 @@ components:
         intents:
           items:
             $ref: "#/components/schemas/DnsIntent"
-          maxItems: 2
+          maxItems: 3
           minItems: 1
           type: array
           uniqueItems: true
@@ -1472,6 +1746,18 @@ components:
           $ref: "#/components/schemas/DomainKind"
         nextStep:
           $ref: "#/components/schemas/DomainNextStep"
+        proxy:
+          additionalProperties: false
+          description: Present once Galascribe turned the provider's proxy on for this binding through a connection (SCHEMA-3.6.0). Absent while the records are DNS-only.
+          properties:
+            provider:
+              $ref: "#/components/schemas/DnsProvider"
+            since:
+              $ref: "#/components/schemas/PortableProblemRfc3339"
+          required:
+            - provider
+            - since
+          type: object
         routing:
           $ref: "#/components/schemas/DomainRouting"
         state:
@@ -1547,11 +1833,13 @@ components:
         expiresAt:
           $ref: "#/components/schemas/PortableProblemRfc3339"
         state:
+          description: "`PROXIED` (SCHEMA-3.6.0): the provider's edge terminates TLS; GitHub's own certificate is not renewed while proxied."
           enum:
             - NONE
             - PENDING
             - ISSUED
             - ERRORED
+            - PROXIED
           type: string
       required:
         - state
@@ -1575,9 +1863,13 @@ components:
           minLength: 1
           type: string
         pointsToGithub:
+          description: True when the hostname resolves to GitHub Pages. It stays false while the binding is proxied, because the name then resolves to the provider's proxy; `viaProxy` carries that case.
           type: boolean
         resolves:
           type: boolean
+        viaProxy:
+          description: True when the hostname resolves to the provider's proxy rather than to GitHub and the binding is proxied (`proxy` is present); the routing probe is then the proof of life (SCHEMA-3.6.0). Absent when the binding is not proxied.
+          type: boolean
       required:
         - resolves
         - pointsToGithub
@@ -1614,7 +1906,7 @@ components:
       type: string
     DomainNextStep:
       additionalProperties: false
-      description: What is being waited on, or what the author should do next. Known codes include `ADD_DNS_RECORDS`, `WAIT_FOR_DNS`, `WAIT_FOR_CERTIFICATE`, `WAIT_FOR_ROUTING`, `PUBLISH_TO_SWITCH`, `FIX_DNS_RECORD`, `REMOVE_DNS_RECORDS` and `NONE`; a client shows `detail` for codes it does not know.
+      description: What is being waited on, or what the author should do next. Known codes include `ADD_DNS_RECORDS`, `WAIT_FOR_DNS`, `WAIT_FOR_CERTIFICATE`, `WAIT_FOR_ROUTING`, `PUBLISH_TO_SWITCH`, `FIX_DNS_RECORD`, `REMOVE_DNS_RECORDS`, `TURN_ON_CLOUDFLARE_PROXY` (SCHEMA-3.6.0, the certificate is issued and the author may let Cloudflare proxy the site) and `NONE`; a client shows `detail` for codes it does not know.
       properties:
         code:
           maxLength: 80
@@ -3214,19 +3506,9 @@ components:
         - items
         - hasMore
       type: object
-    GetPlatformAdaptersResponse:
-      additionalProperties: false
-      properties:
-        items:
-          items:
-            $ref: "#/components/schemas/PlatformAdapter"
-          maxItems: 100
-          minItems: 0
-          type: array
-      required:
-        - items
-      type: object
-    GetPlatformAuditEventsResponse:
+    GetPlatformAbuseCasesByCommentIdResponse:
+      $ref: "#/components/schemas/PlatformAbuseCaseDetail"
+    GetPlatformAbuseCasesResponse:
       additionalProperties: false
       allOf:
         - else:
@@ -3254,11 +3536,11 @@ components:
           type: boolean
         items:
           items:
-            $ref: "#/components/schemas/PlatformAuditEvent"
+            $ref: "#/components/schemas/PlatformAbuseCaseSummary"
           maxItems: 100
           type: array
         nextCursor:
-          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false. The length bounds constrain the string branch only.
+          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false.
           maxLength: 2048
           minLength: 1
           type:
@@ -3268,134 +3550,468 @@ components:
         - items
         - hasMore
       type: object
-    GetPlatformConfigurationResponse:
+    GetPlatformAdaptersResponse:
       additionalProperties: false
       properties:
-        families:
+        items:
           items:
-            additionalProperties: false
-            properties:
-              family:
-                maxLength: 80
-                minLength: 1
-                type: string
-              keys:
-                items:
-                  $ref: "#/components/schemas/PlatformConfigurationKey"
-                maxItems: 200
-                minItems: 0
-                type: array
-            required:
-              - family
-              - keys
-            type: object
+            $ref: "#/components/schemas/PlatformAdapter"
           maxItems: 100
           minItems: 0
           type: array
-      required:
-        - families
-      type: object
-    GetPublicPublicationsByPublicationIdContentsByContentIdCommentsResponse:
-      additionalProperties: false
-      properties:
-        count:
-          oneOf:
-            - $ref: "#/components/schemas/PublicCount"
-            - type: "null"
-        items:
-          items:
-            $ref: "#/components/schemas/CommentView"
-          maxItems: 50
-          type: array
-        nextCursor:
-          maxLength: 2048
-          minLength: 1
-          type:
-            - string
-            - "null"
       required:
         - items
-        - nextCursor
-        - count
-      type: object
-    GetPublicPublicationsByPublicationIdContentsByContentIdInteractionsResponse:
-      additionalProperties: false
-      properties:
-        asOf:
-          description: "Canonical Gala instant: the UTC millisecond subset of RFC 3339, exactly `YYYY-MM-DDThh:mm:ss.sssZ`. Stated here rather than as a `pattern` because a generated `OffsetDateTime` cannot carry one (LOCAL-56)."
-          format: date-time
-          type: string
-        comments:
-          additionalProperties: false
-          properties:
-            allowReplies:
-              type: boolean
-            enabled:
-              type: boolean
-            maxDepth:
-              maximum: 4
-              minimum: 1
-              type: integer
-            open:
-              type: boolean
-          required:
-            - enabled
-            - open
-            - allowReplies
-            - maxDepth
-          type: object
-        reactions:
-          additionalProperties: false
-          properties:
-            enabled:
-              type: boolean
-            items:
-              items:
-                $ref: "#/components/schemas/PublicReactionItem"
-              maxItems: 17
-              type: array
-          required:
-            - enabled
-            - items
-          type: object
-        viewer:
-          oneOf:
-            - $ref: "#/components/schemas/ReaderView"
-            - type: "null"
-      required:
-        - reactions
-        - comments
-        - viewer
-        - asOf
-      type: object
-    GetPublicPublicationsByPublicationIdResponse:
-      additionalProperties: false
-      properties:
-        name:
-          maxLength: 120
-          minLength: 1
-          type: string
-        origin:
-          maxLength: 255
-          minLength: 1
-          pattern: ^(?:https://[^\s]+|http://(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?(?:/[^\s]*)?)$
-          type: string
-        publicBaseUrl:
-          maxLength: 2048
-          minLength: 1
-          pattern: ^(?:https://[^\s]+|http://(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?(?:/[^\s]*)?)$
-          type: string
-        publicationId:
-          format: uuid
-          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
-          type: string
-      required:
-        - publicationId
-        - name
-        - origin
-        - publicBaseUrl
       type: object
-    GetSelfAuthenticatorsResponse:
+    GetPlatformAuditEventsResponse:
+      additionalProperties: false
+      allOf:
+        - else:
+            properties:
+              nextCursor:
+                type: "null"
+          if:
+            properties:
+              hasMore:
+                not:
+                  enum:
+                    - false
+                type: boolean
+                x-gala-const: true
+            required:
+              - hasMore
+          then:
+            properties:
+              nextCursor:
+                type: string
+            required:
+              - nextCursor
+      properties:
+        hasMore:
+          type: boolean
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformAuditEvent"
+          maxItems: 100
+          type: array
+        nextCursor:
+          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false. The length bounds constrain the string branch only.
+          maxLength: 2048
+          minLength: 1
+          type:
+            - string
+            - "null"
+      required:
+        - items
+        - hasMore
+      type: object
+    GetPlatformCachesResponse:
+      additionalProperties: false
+      properties:
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformCache"
+          maxItems: 100
+          type: array
+      required:
+        - items
+      type: object
+    GetPlatformConfigurationResponse:
+      additionalProperties: false
+      properties:
+        families:
+          items:
+            additionalProperties: false
+            properties:
+              family:
+                maxLength: 80
+                minLength: 1
+                type: string
+              keys:
+                items:
+                  $ref: "#/components/schemas/PlatformConfigurationKey"
+                maxItems: 200
+                minItems: 0
+                type: array
+            required:
+              - family
+              - keys
+            type: object
+          maxItems: 100
+          minItems: 0
+          type: array
+      required:
+        - families
+      type: object
+    GetPlatformOauthClientsResponse:
+      additionalProperties: false
+      properties:
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformOauthClient"
+          maxItems: 500
+          type: array
+      required:
+        - items
+      type: object
+    GetPlatformOverviewResponse:
+      additionalProperties: false
+      properties:
+        commentDeletedByAuthor:
+          format: int64
+          minimum: 0
+          type: integer
+        commentHeldReview:
+          format: int64
+          minimum: 0
+          type: integer
+        commentRemoved:
+          format: int64
+          minimum: 0
+          type: integer
+        commentVisible:
+          format: int64
+          minimum: 0
+          type: integer
+        commentVisibleFlagged:
+          format: int64
+          minimum: 0
+          type: integer
+        commentVisiblePendingScan:
+          format: int64
+          minimum: 0
+          type: integer
+        oauthClientDraft:
+          format: int64
+          minimum: 0
+          type: integer
+        oauthClientRevoked:
+          format: int64
+          minimum: 0
+          type: integer
+        openAbuseCases:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationActive:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationBusiness:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationClosed:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationClosing:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationFree:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationPro:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationProvisioning:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationSuspended:
+          format: int64
+          minimum: 0
+          type: integer
+        personActive:
+          format: int64
+          minimum: 0
+          type: integer
+        personClosed:
+          format: int64
+          minimum: 0
+          type: integer
+        personClosing:
+          format: int64
+          minimum: 0
+          type: integer
+        personRestricted:
+          format: int64
+          minimum: 0
+          type: integer
+        personSuspended:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationActive:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationPaused:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationProvisioning:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationRetired:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationRetiring:
+          format: int64
+          minimum: 0
+          type: integer
+        reactionActive:
+          format: int64
+          minimum: 0
+          type: integer
+        reactionInactive:
+          format: int64
+          minimum: 0
+          type: integer
+        webhookProcessed7d:
+          format: int64
+          minimum: 0
+          type: integer
+        webhookProcessing7d:
+          format: int64
+          minimum: 0
+          type: integer
+        webhookQuarantined7d:
+          format: int64
+          minimum: 0
+          type: integer
+        webhookReceived7d:
+          format: int64
+          minimum: 0
+          type: integer
+      required:
+        - personActive
+        - personSuspended
+        - personRestricted
+        - personClosing
+        - personClosed
+        - organizationProvisioning
+        - organizationActive
+        - organizationSuspended
+        - organizationClosing
+        - organizationClosed
+        - organizationFree
+        - organizationPro
+        - organizationBusiness
+        - publicationProvisioning
+        - publicationActive
+        - publicationPaused
+        - publicationRetiring
+        - publicationRetired
+        - commentVisiblePendingScan
+        - commentVisible
+        - commentVisibleFlagged
+        - commentHeldReview
+        - commentRemoved
+        - commentDeletedByAuthor
+        - reactionActive
+        - reactionInactive
+        - oauthClientDraft
+        - oauthClientRevoked
+        - openAbuseCases
+        - webhookReceived7d
+        - webhookProcessing7d
+        - webhookProcessed7d
+        - webhookQuarantined7d
+      type: object
+    GetPlatformPlansResponse:
+      $ref: "#/components/schemas/PlatformPlanCapacityRelease"
+    GetPlatformUsersResponse:
+      additionalProperties: false
+      allOf:
+        - else:
+            properties:
+              nextCursor:
+                type: "null"
+          if:
+            properties:
+              hasMore:
+                not:
+                  enum:
+                    - false
+                type: boolean
+                x-gala-const: true
+            required:
+              - hasMore
+          then:
+            properties:
+              nextCursor:
+                type: string
+            required:
+              - nextCursor
+      properties:
+        hasMore:
+          type: boolean
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformUser"
+          maxItems: 100
+          type: array
+        nextCursor:
+          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false.
+          maxLength: 2048
+          minLength: 1
+          type:
+            - string
+            - "null"
+      required:
+        - items
+        - hasMore
+      type: object
+    GetPlatformWebhookEventsByEventIdResponse:
+      $ref: "#/components/schemas/PlatformWebhookEvent"
+    GetPlatformWebhookEventsResponse:
+      additionalProperties: false
+      allOf:
+        - else:
+            properties:
+              nextCursor:
+                type: "null"
+          if:
+            properties:
+              hasMore:
+                not:
+                  enum:
+                    - false
+                type: boolean
+                x-gala-const: true
+            required:
+              - hasMore
+          then:
+            properties:
+              nextCursor:
+                type: string
+            required:
+              - nextCursor
+      properties:
+        hasMore:
+          type: boolean
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformWebhookEvent"
+          maxItems: 100
+          type: array
+        nextCursor:
+          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false.
+          maxLength: 2048
+          minLength: 1
+          type:
+            - string
+            - "null"
+      required:
+        - items
+        - hasMore
+      type: object
+    GetPublicPublicationsByPublicationIdContentsByContentIdCommentsResponse:
+      additionalProperties: false
+      properties:
+        count:
+          oneOf:
+            - $ref: "#/components/schemas/PublicCount"
+            - type: "null"
+        items:
+          items:
+            $ref: "#/components/schemas/CommentView"
+          maxItems: 50
+          type: array
+        nextCursor:
+          maxLength: 2048
+          minLength: 1
+          type:
+            - string
+            - "null"
+      required:
+        - items
+        - nextCursor
+        - count
+      type: object
+    GetPublicPublicationsByPublicationIdContentsByContentIdInteractionsResponse:
+      additionalProperties: false
+      properties:
+        asOf:
+          description: "Canonical Gala instant: the UTC millisecond subset of RFC 3339, exactly `YYYY-MM-DDThh:mm:ss.sssZ`. Stated here rather than as a `pattern` because a generated `OffsetDateTime` cannot carry one (LOCAL-56)."
+          format: date-time
+          type: string
+        comments:
+          additionalProperties: false
+          properties:
+            allowReplies:
+              type: boolean
+            enabled:
+              type: boolean
+            maxDepth:
+              maximum: 4
+              minimum: 1
+              type: integer
+            open:
+              type: boolean
+          required:
+            - enabled
+            - open
+            - allowReplies
+            - maxDepth
+          type: object
+        reactions:
+          additionalProperties: false
+          properties:
+            enabled:
+              type: boolean
+            items:
+              items:
+                $ref: "#/components/schemas/PublicReactionItem"
+              maxItems: 17
+              type: array
+          required:
+            - enabled
+            - items
+          type: object
+        viewer:
+          oneOf:
+            - $ref: "#/components/schemas/ReaderView"
+            - type: "null"
+      required:
+        - reactions
+        - comments
+        - viewer
+        - asOf
+      type: object
+    GetPublicPublicationsByPublicationIdResponse:
+      additionalProperties: false
+      properties:
+        name:
+          maxLength: 120
+          minLength: 1
+          type: string
+        origin:
+          maxLength: 255
+          minLength: 1
+          pattern: ^(?:https://[^\s]+|http://(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?(?:/[^\s]*)?)$
+          type: string
+        publicBaseUrl:
+          maxLength: 2048
+          minLength: 1
+          pattern: ^(?:https://[^\s]+|http://(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?(?:/[^\s]*)?)$
+          type: string
+        publicationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+      required:
+        - publicationId
+        - name
+        - origin
+        - publicBaseUrl
+      type: object
+    GetSelfAuthenticatorsResponse:
       additionalProperties: false
       allOf:
         - else:
@@ -5751,6 +6367,114 @@ components:
         - label
         - createdAt
       type: object
+    PlatformAbuseCaseDetail:
+      additionalProperties: false
+      description: Review evidence for one abuse case. Report reasons include only open reports and are sorted and distinct; reporter identities and notes are never exposed.
+      properties:
+        body:
+          maxLength: 20000
+          type: string
+        commentId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        commentState:
+          $ref: "#/components/schemas/CommentInternalState"
+        contentId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        firstReportedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        lastReportedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        openReportCount:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        parentId:
+          oneOf:
+            - format: uuid
+              pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+              type: string
+            - type: "null"
+        publicationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        reportReasons:
+          items:
+            $ref: "#/components/schemas/ReaderReportReason"
+          maxItems: 8
+          type: array
+          uniqueItems: true
+        totalReportCount:
+          format: int64
+          minimum: 0
+          type: integer
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+      required:
+        - commentId
+        - organizationId
+        - publicationId
+        - commentState
+        - openReportCount
+        - totalReportCount
+        - firstReportedAt
+        - lastReportedAt
+        - updatedAt
+        - body
+        - contentId
+        - parentId
+        - reportReasons
+      type: object
+    PlatformAbuseCaseSummary:
+      additionalProperties: false
+      properties:
+        commentId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        commentState:
+          $ref: "#/components/schemas/CommentInternalState"
+        firstReportedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        lastReportedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        openReportCount:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        publicationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        totalReportCount:
+          format: int64
+          minimum: 0
+          type: integer
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+      required:
+        - commentId
+        - organizationId
+        - publicationId
+        - commentState
+        - openReportCount
+        - totalReportCount
+        - firstReportedAt
+        - lastReportedAt
+        - updatedAt
+      type: object
     PlatformAdapter:
       additionalProperties: false
       description: One admitted adapter (publish toolchain release or provider adapter). Today every admitted row reads `ADMITTED`; `SUSPENDED` and `SUPERSEDED` are reserved for the suspend/restore and supersession flows.
@@ -5851,6 +6575,49 @@ components:
         - outcomeCode
         - correlationId
       type: object
+    PlatformCache:
+      additionalProperties: false
+      properties:
+        epoch:
+          format: int64
+          minimum: 0
+          type: integer
+        localEntryCount:
+          format: int64
+          minimum: 0
+          type: integer
+        name:
+          enum:
+            - GITHUB_INSTALLATION_TOKEN
+            - GITHUB_REPOSITORY_METADATA
+            - GITHUB_REPOSITORY_CONTENT
+          type: string
+        ttlSeconds:
+          format: int64
+          minimum: 1
+          type: integer
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        updatedByPersonId:
+          description: The last evicting operator, or null before the cache's first eviction.
+          oneOf:
+            - format: uuid
+              pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+              type: string
+            - type: "null"
+        version:
+          format: int64
+          minimum: 0
+          type: integer
+      required:
+        - name
+        - epoch
+        - localEntryCount
+        - ttlSeconds
+        - updatedByPersonId
+        - updatedAt
+        - version
+      type: object
     PlatformConfigurationKey:
       additionalProperties: false
       description: One configuration value as canonical text (`20`, `false`, `PT5M`); `source` says whether it is the compiled catalog default or an environment override.
@@ -5899,6 +6666,361 @@ components:
         - source
         - description
       type: object
+    PlatformOauthClient:
+      additionalProperties: false
+      properties:
+        accessTokenTtlSeconds:
+          maximum: 86400
+          minimum: 300
+          type: integer
+        clientId:
+          maxLength: 160
+          minLength: 24
+          pattern: ^[A-Za-z0-9._~-]+$
+          type: string
+        clientType:
+          $ref: "#/components/schemas/PlatformOauthClientType"
+        createdAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        createdByPersonId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        description:
+          oneOf:
+            - $ref: "#/components/schemas/PlatformOauthClientDescriptionText"
+            - type: "null"
+        grantTypes:
+          items:
+            $ref: "#/components/schemas/PlatformOauthGrantType"
+          maxItems: 3
+          minItems: 1
+          type: array
+          uniqueItems: true
+        homepageUri:
+          oneOf:
+            - $ref: "#/components/schemas/PlatformOauthClientHttpsUri"
+            - type: "null"
+        id:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        logoUri:
+          oneOf:
+            - $ref: "#/components/schemas/PlatformOauthClientHttpsUri"
+            - type: "null"
+        name:
+          maxLength: 120
+          minLength: 1
+          type: string
+        redirectUris:
+          items:
+            format: uri
+            maxLength: 2048
+            minLength: 8
+            pattern: ^(?:https://[^/\s#]+/|http://(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?/)[^\s#]*$
+            type: string
+          maxItems: 20
+          type: array
+          uniqueItems: true
+        revokedAt:
+          oneOf:
+            - $ref: "#/components/schemas/PortableProblemRfc3339"
+            - type: "null"
+        scopes:
+          items:
+            $ref: "#/components/schemas/PlatformOauthScope"
+          maxItems: 3
+          minItems: 1
+          type: array
+          uniqueItems: true
+        state:
+          enum:
+            - DRAFT
+            - REVOKED
+          type: string
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        version:
+          format: int64
+          minimum: 0
+          type: integer
+      required:
+        - id
+        - clientId
+        - name
+        - description
+        - clientType
+        - grantTypes
+        - redirectUris
+        - scopes
+        - accessTokenTtlSeconds
+        - logoUri
+        - homepageUri
+        - state
+        - createdByPersonId
+        - createdAt
+        - updatedAt
+        - revokedAt
+        - version
+      type: object
+    PlatformOauthClientDescriptionText:
+      maxLength: 1000
+      minLength: 1
+      type: string
+    PlatformOauthClientHttpsUri:
+      format: uri
+      maxLength: 2048
+      minLength: 8
+      pattern: ^https://[^\s#]+$
+      type: string
+    PlatformOauthClientType:
+      enum:
+        - PUBLIC
+        - CONFIDENTIAL
+      type: string
+    PlatformOauthGrantType:
+      enum:
+        - AUTHORIZATION_CODE
+        - REFRESH_TOKEN
+        - CLIENT_CREDENTIALS
+      type: string
+    PlatformOauthScope:
+      enum:
+        - read
+        - write
+        - metrics:read
+      type: string
+    PlatformOperatorReasonCode:
+      description: Non-sensitive operator reason code recorded in the audit event.
+      maxLength: 80
+      minLength: 1
+      pattern: ^[A-Z][A-Z0-9_]{0,79}$
+      type: string
+    PlatformPersonState:
+      enum:
+        - ACTIVE
+        - SUSPENDED
+        - RESTRICTED
+        - CLOSING
+        - CLOSED
+      type: string
+    PlatformPlan:
+      additionalProperties: false
+      properties:
+        planKey:
+          $ref: "#/components/schemas/PlatformPlanKey"
+        publicationLimit:
+          format: int64
+          minimum: 1
+          type: integer
+      required:
+        - planKey
+        - publicationLimit
+      type: object
+    PlatformPlanCapacityRelease:
+      additionalProperties: false
+      properties:
+        effectiveAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        items:
+          allOf:
+            - contains:
+                properties:
+                  planKey:
+                    pattern: ^FREE$
+                    type: string
+                    x-gala-const: FREE
+                required:
+                  - planKey
+                type: object
+              maxContains: 1
+              minContains: 1
+            - contains:
+                properties:
+                  planKey:
+                    pattern: ^PRO$
+                    type: string
+                    x-gala-const: PRO
+                required:
+                  - planKey
+                type: object
+              maxContains: 1
+              minContains: 1
+            - contains:
+                properties:
+                  planKey:
+                    pattern: ^BUSINESS$
+                    type: string
+                    x-gala-const: BUSINESS
+                required:
+                  - planKey
+                type: object
+              maxContains: 1
+              minContains: 1
+          items:
+            $ref: "#/components/schemas/PlatformPlan"
+          maxItems: 3
+          minItems: 3
+          type: array
+        releaseId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        releaseVersion:
+          format: int64
+          minimum: 1
+          type: integer
+        state:
+          pattern: ^ACTIVE$
+          type: string
+          x-gala-const: ACTIVE
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+      required:
+        - releaseId
+        - releaseVersion
+        - state
+        - effectiveAt
+        - updatedAt
+        - items
+      type: object
+    PlatformPlanKey:
+      enum:
+        - FREE
+        - PRO
+        - BUSINESS
+      type: string
+    PlatformUser:
+      additionalProperties: false
+      properties:
+        createdAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        displayName:
+          maxLength: 255
+          type:
+            - string
+            - "null"
+        lastSignInAt:
+          oneOf:
+            - $ref: "#/components/schemas/PortableProblemRfc3339"
+            - type: "null"
+        login:
+          maxLength: 80
+          minLength: 1
+          type:
+            - string
+            - "null"
+        personId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        planTiers:
+          items:
+            $ref: "#/components/schemas/PlatformPlanKey"
+          maxItems: 3
+          type: array
+          uniqueItems: true
+        publicationCount:
+          format: int64
+          minimum: 0
+          type: integer
+        state:
+          $ref: "#/components/schemas/PlatformPersonState"
+      required:
+        - personId
+        - state
+        - displayName
+        - login
+        - createdAt
+        - lastSignInAt
+        - publicationCount
+        - planTiers
+      type: object
+    PlatformWebhookEvent:
+      additionalProperties: false
+      description: Redacted webhook inbox metadata and immutable routing coordinates. The request body and payload digest are deliberately never exposed.
+      properties:
+        attemptCount:
+          minimum: 0
+          type: integer
+        attemptLimit:
+          minimum: 1
+          type: integer
+        eventId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        eventType:
+          $ref: "#/components/schemas/PlatformWebhookEventType"
+        firstSeenAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        organizationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        processedAt:
+          oneOf:
+            - $ref: "#/components/schemas/PortableProblemRfc3339"
+            - type: "null"
+        providerRepositoryId:
+          format: int64
+          minimum: 1
+          type:
+            - integer
+            - "null"
+        pullRequestNumber:
+          format: int64
+          minimum: 1
+          type:
+            - integer
+            - "null"
+        resultCode:
+          maxLength: 120
+          minLength: 1
+          pattern: ^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$
+          type:
+            - string
+            - "null"
+        status:
+          $ref: "#/components/schemas/PlatformWebhookProcessingStatus"
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        workflowRunId:
+          format: int64
+          minimum: 1
+          type:
+            - integer
+            - "null"
+      required:
+        - eventId
+        - organizationId
+        - eventType
+        - status
+        - providerRepositoryId
+        - pullRequestNumber
+        - workflowRunId
+        - attemptCount
+        - attemptLimit
+        - resultCode
+        - firstSeenAt
+        - processedAt
+        - updatedAt
+      type: object
+    PlatformWebhookEventType:
+      enum:
+        - PULL_REQUEST
+        - PUSH
+        - WORKFLOW_RUN
+        - OTHER
+      type: string
+    PlatformWebhookProcessingStatus:
+      enum:
+        - RECEIVED
+        - PROCESSING
+        - PROCESSED
+        - QUARANTINED
+      type: string
     PortableAppearanceAttribution:
       additionalProperties: false
       description: 'Footer attribution. `showMadeWith: false` omits the "Made with Galascribe" mark; an absent `attribution` means it is shown.'
@@ -11747,6 +12869,10 @@ components:
             - REAUTH
             - RECOVERY
           type: string
+        selectAccount:
+          default: false
+          description: Ask GitHub to show its account picker (`prompt=select_account`) instead of reusing the browser's GitHub session (SCHEMA-3.6.0).
+          type: boolean
       required:
         - purpose
       type: object
@@ -13122,6 +14248,11 @@ components:
     PostOrganizationsByOrganizationIdPublicationsByPublicationIdReviewsByReviewIdDecideRequest:
       additionalProperties: false
       properties:
+        comment:
+          description: Optional plain-text note from the reviewer, 1 to 4000 characters (SCHEMA-3.6.0). A longer or empty comment is `VALIDATION_FAILED` with pointer `/comment`.
+          maxLength: 4000
+          minLength: 1
+          type: string
         decision:
           enum:
             - APPROVE
@@ -13138,9 +14269,22 @@ components:
     PostOrganizationsByOrganizationIdPublicationsByPublicationIdReviewsByReviewIdDecideResponse:
       additionalProperties: false
       properties:
+        comment:
+          description: The newest decision's reviewer comment (SCHEMA-3.6.0). Absent when the decision carried none.
+          maxLength: 4000
+          minLength: 1
+          type: string
+        decidedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        decidedBy:
+          $ref: "#/components/schemas/SiteActor"
         findingsDigest:
           pattern: ^sha256:[0-9a-f]{64}$
           type: string
+        requestedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        requestedBy:
+          $ref: "#/components/schemas/SiteActor"
         reviewId:
           format: uuid
           pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
@@ -13478,6 +14622,180 @@ components:
         - name
         - slug
       type: object
+    PostPlatformAbuseCasesByCommentIdDecideRequest:
+      additionalProperties: false
+      properties:
+        decision:
+          $ref: "#/components/schemas/ModerationDecision"
+        note:
+          maxLength: 1000
+          type:
+            - string
+            - "null"
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+      required:
+        - decision
+        - note
+        - reason
+      type: object
+    PostPlatformAbuseCasesByCommentIdDecideResponse:
+      $ref: "#/components/schemas/PlatformAbuseCaseDetail"
+    PostPlatformCachesByCacheIdEvictRequest:
+      additionalProperties: false
+      properties:
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+      required:
+        - reason
+      type: object
+    PostPlatformCachesByCacheIdEvictResponse:
+      $ref: "#/components/schemas/PlatformCache"
+    PostPlatformOauthClientsByOauthClientIdRevokeRequest:
+      additionalProperties: false
+      properties:
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+      required:
+        - reason
+      type: object
+    PostPlatformOauthClientsByOauthClientIdRevokeResponse:
+      $ref: "#/components/schemas/PlatformOauthClient"
+    PostPlatformOauthClientsRequest:
+      additionalProperties: false
+      allOf:
+        - else:
+            properties:
+              redirectUris:
+                maxItems: 0
+          if:
+            properties:
+              grantTypes:
+                contains:
+                  pattern: ^AUTHORIZATION_CODE$
+                  type: string
+                  x-gala-const: AUTHORIZATION_CODE
+            required:
+              - grantTypes
+          then:
+            properties:
+              redirectUris:
+                minItems: 1
+        - if:
+            properties:
+              grantTypes:
+                contains:
+                  pattern: ^REFRESH_TOKEN$
+                  type: string
+                  x-gala-const: REFRESH_TOKEN
+            required:
+              - grantTypes
+          then:
+            properties:
+              grantTypes:
+                contains:
+                  pattern: ^AUTHORIZATION_CODE$
+                  type: string
+                  x-gala-const: AUTHORIZATION_CODE
+        - if:
+            properties:
+              clientType:
+                pattern: ^PUBLIC$
+                type: string
+                x-gala-const: PUBLIC
+            required:
+              - clientType
+          then:
+            properties:
+              grantTypes:
+                not:
+                  contains:
+                    pattern: ^CLIENT_CREDENTIALS$
+                    type: string
+                    x-gala-const: CLIENT_CREDENTIALS
+      properties:
+        accessTokenTtlSeconds:
+          maximum: 86400
+          minimum: 300
+          type: integer
+        clientType:
+          $ref: "#/components/schemas/PlatformOauthClientType"
+        description:
+          maxLength: 1000
+          minLength: 1
+          type:
+            - string
+            - "null"
+        grantTypes:
+          items:
+            $ref: "#/components/schemas/PlatformOauthGrantType"
+          maxItems: 3
+          minItems: 1
+          type: array
+          uniqueItems: true
+        homepageUri:
+          format: uri
+          maxLength: 2048
+          minLength: 8
+          pattern: ^https://[^\s#]+$
+          type:
+            - string
+            - "null"
+        logoUri:
+          format: uri
+          maxLength: 2048
+          minLength: 8
+          pattern: ^https://[^\s#]+$
+          type:
+            - string
+            - "null"
+        name:
+          maxLength: 120
+          minLength: 1
+          type: string
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+        redirectUris:
+          items:
+            format: uri
+            maxLength: 2048
+            minLength: 8
+            pattern: ^(?:https://[^/\s#]+/|http://(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?/)[^\s#]*$
+            type: string
+          maxItems: 20
+          type: array
+          uniqueItems: true
+        scopes:
+          items:
+            $ref: "#/components/schemas/PlatformOauthScope"
+          maxItems: 3
+          minItems: 1
+          type: array
+          uniqueItems: true
+      required:
+        - name
+        - clientType
+        - grantTypes
+        - redirectUris
+        - scopes
+        - accessTokenTtlSeconds
+        - reason
+      type: object
+    PostPlatformOauthClientsResponse:
+      additionalProperties: false
+      description: A CONFIDENTIAL client's secret is disclosed only by the first successful create response. PUBLIC clients and committed idempotent retries return `clientSecret` null or omitted because plaintext secrets are not stored. It is never returned by a later read.
+      properties:
+        client:
+          $ref: "#/components/schemas/PlatformOauthClient"
+        clientSecret:
+          maxLength: 512
+          minLength: 32
+          type:
+            - string
+            - "null"
+      required:
+        - client
+      type: object
     PostPublicCommentsByCommentIdAppealsRequest:
       additionalProperties: false
       properties:
@@ -14980,6 +16298,21 @@ components:
       required:
         - change
       type: object
+    PutPlatformPlansByPlanKeyRequest:
+      additionalProperties: false
+      properties:
+        publicationLimit:
+          format: int64
+          minimum: 1
+          type: integer
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+      required:
+        - publicationLimit
+        - reason
+      type: object
+    PutPlatformPlansByPlanKeyResponse:
+      $ref: "#/components/schemas/PlatformPlanCapacityRelease"
     PutPublicPublicationsByPublicationIdContentsByContentIdReactionsByReactionKeyResponse:
       additionalProperties: false
       properties:
@@ -15831,9 +17164,22 @@ components:
         review read returns, so a list row and a read of that row never
         disagree.
       properties:
+        comment:
+          description: The newest decision's reviewer comment (SCHEMA-3.6.0). Absent when the decision carried none.
+          maxLength: 4000
+          minLength: 1
+          type: string
+        decidedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        decidedBy:
+          $ref: "#/components/schemas/SiteActor"
         findingsDigest:
           pattern: ^sha256:[0-9a-f]{64}$
           type: string
+        requestedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        requestedBy:
+          $ref: "#/components/schemas/SiteActor"
         reviewId:
           format: uuid
           pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
@@ -16152,14 +17498,29 @@ components:
           maxLength: 512
           minLength: 1
           type: string
+        pullRequestUrl:
+          description: The mirror of this change on GitHub (SCHEMA-3.6.0), the canonical GitHub pull-request URL, as `GithubPullRequestSummary.url`. Absent until a pull request is recorded.
+          format: uri
+          pattern: ^https://github[.]com/[A-Za-z0-9][A-Za-z0-9-]{0,38}/[A-Za-z0-9_.-]{1,100}/pull/[1-9][0-9]*$
+          type: string
         review:
-          description: "`NOT_REQUIRED` when the publication does not require review; otherwise `WAITING`, `APPROVED` or `CHANGES_REQUESTED`."
+          description: "`NOT_REQUIRED` when the publication does not require review; otherwise `WAITING`, `APPROVED` or `CHANGES_REQUESTED`. `NEEDS_RE_REVIEW` (SCHEMA-3.6.0): the reviewed revision was replaced by a newer one and the author requests review again."
           enum:
             - NOT_REQUIRED
             - WAITING
             - APPROVED
             - CHANGES_REQUESTED
+            - NEEDS_RE_REVIEW
           type: string
+        reviewComment:
+          description: The newest decision's comment (SCHEMA-3.6.0), shown to the author next to the change. Absent when none.
+          maxLength: 4000
+          minLength: 1
+          type: string
+        reviewDecidedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        reviewDecidedBy:
+          $ref: "#/components/schemas/SiteActor"
         reviewId:
           description: The review a reviewer decides through `POST .../reviews/{reviewId}:decide`. Present when a review exists.
           format: uuid
@@ -33642,6 +35003,82 @@ paths:
                     state: CERTIFICATE_PENDING
                     updatedAt: "2026-10-09T12:00:00.000Z"
                     version: 3
+                proxied:
+                  summary: Live behind Cloudflare's proxy
+                  value:
+                    canonicalBase:
+                      current: https://blog.maya.dev/
+                      published: true
+                      target: https://blog.maya.dev/
+                    certificate:
+                      state: PROXIED
+                    createdAt: "2026-10-09T12:00:00.000Z"
+                    dns:
+                      observed:
+                        addresses:
+                          - 104.21.0.1
+                        checkedAt: "2026-10-10T12:00:00.000Z"
+                        pointsToGithub: false
+                        resolves: true
+                        viaProxy: true
+                      records:
+                        - name: blog
+                          type: CNAME
+                          value: rathnastest.github.io
+                    domainId: 018f0000-0000-7000-8000-000000000001
+                    hostname: blog.maya.dev
+                    kind: SUBDOMAIN
+                    nextStep:
+                      code: NONE
+                      detail: Your site is live behind Cloudflare's proxy.
+                    proxy:
+                      provider: CLOUDFLARE
+                      since: "2026-10-10T12:00:00.000Z"
+                    routing:
+                      httpsEnforced: false
+                      probeOk: true
+                      servedByPages: true
+                    state: ACTIVE
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+                    version: 9
+                stage2Offer:
+                  summary: Certificate issued; the proxy can be turned on
+                  value:
+                    canonicalBase:
+                      current: https://blog.maya.dev/
+                      published: true
+                      target: https://blog.maya.dev/
+                    certificate:
+                      state: ISSUED
+                    createdAt: "2026-10-09T12:00:00.000Z"
+                    dns:
+                      observed:
+                        addresses: []
+                        checkedAt: "2026-10-10T12:00:00.000Z"
+                        cnameTarget: rathnastest.github.io
+                        pointsToGithub: true
+                        resolves: true
+                      providers:
+                        - intents:
+                            - PROXY
+                          provider: CLOUDFLARE
+                      records:
+                        - name: blog
+                          type: CNAME
+                          value: rathnastest.github.io
+                    domainId: 018f0000-0000-7000-8000-000000000001
+                    hostname: blog.maya.dev
+                    kind: SUBDOMAIN
+                    nextStep:
+                      code: TURN_ON_CLOUDFLARE_PROXY
+                      detail: Your certificate is issued. You can now let Cloudflare proxy the site.
+                    routing:
+                      httpsEnforced: true
+                      probeOk: true
+                      servedByPages: true
+                    state: ACTIVE
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+                    version: 8
               schema:
                 $ref: "#/components/schemas/PostOrganizationsByOrganizationIdPublicationsByPublicationIdDomainsByDomainIdCheckResponse"
           description: check a custom domain now succeeded
@@ -41870,6 +43307,8 @@ paths:
         Authenticated server-sent notification stream for review state changes.
         Events carry no authority or canonical state; a client re-reads the
         ordinary review and repository-change resources after each signal.
+        SCHEMA-3.6.0: the comment, decision time and actor, request time and
+        actor (`ReviewSummary`) arrive on that re-read, never in the event.
       operationId: getOrganizationsByOrganizationIdPublicationsByPublicationIdReviewsEvents
       parameters:
         - $ref: "#/components/parameters/XCorrelationId"
@@ -42221,7 +43660,8 @@ paths:
               nominal:
                 summary: Nominal valid request
                 value:
-                  decision: APPROVE
+                  comment: Please soften the second paragraph.
+                  decision: REJECT
                   reasonCode: example
             schema:
               $ref: "#/components/schemas/PostOrganizationsByOrganizationIdPublicationsByPublicationIdReviewsByReviewIdDecideRequest"
@@ -42234,10 +43674,17 @@ paths:
                 nominal:
                   summary: Nominal successful response
                   value:
+                    comment: Please soften the second paragraph.
+                    decidedAt: "2026-10-10T12:00:00.000Z"
+                    decidedBy:
+                      displayName: Maya Rao
+                    requestedAt: "2026-10-10T11:00:00.000Z"
+                    requestedBy:
+                      displayName: Sam Lee
                     reviewId: 018f0000-0000-7000-8000-000000000001
                     sourceRevision: sha1:0000000000000000000000000000000000000000
-                    state: REQUESTED
-                    version: 0
+                    state: REJECTED
+                    version: 1
               schema:
                 $ref: "#/components/schemas/PostOrganizationsByOrganizationIdPublicationsByPublicationIdReviewsByReviewIdDecideResponse"
           description: approve or reject exact reviewed revision succeeded
@@ -42585,7 +44032,12 @@ paths:
                         changeId: 018f0000-0000-7000-8000-000000000002
                         kind: POST
                         path: content/articles/hello.md
-                        review: NOT_REQUIRED
+                        pullRequestUrl: https://github.com/rathnastest/g11/pull/7
+                        review: NEEDS_RE_REVIEW
+                        reviewComment: Please soften the second paragraph.
+                        reviewDecidedAt: "2026-10-05T09:00:00Z"
+                        reviewDecidedBy:
+                          displayName: Maya Rao
                         title: Hello, world
                         updatedAt: "2026-10-05T09:30:00Z"
                       - action: CHANGE
@@ -45557,6 +47009,258 @@ paths:
         - NONE
       x-gala-success-category: query
       x-gala-tenant-scope: ORGANIZATION_PATH
+  /v2/platform/abuse-cases:
+    get:
+      description: |
+        Operators only, with recent authentication. Keyset-paged moderation
+        cases across every organization. Rows expose only identifiers, state,
+        report counts, and ordering instants; comment bodies and report reasons
+        are available only from the detail operation.
+      operationId: getPlatformAbuseCases
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    hasMore: false
+                    items:
+                      - commentId: 018f0000-0000-7000-8000-000000000003
+                        commentState: VISIBLE_PENDING_SCAN
+                        firstReportedAt: "2026-10-10T10:30:00.000Z"
+                        lastReportedAt: "2026-10-10T11:00:00.000Z"
+                        openReportCount: 1
+                        organizationId: 018f0000-0000-7000-8000-000000000001
+                        publicationId: 018f0000-0000-7000-8000-000000000002
+                        totalReportCount: 1
+                        updatedAt: "2026-10-10T11:00:00.000Z"
+                    nextCursor: null
+              schema:
+                $ref: "#/components/schemas/GetPlatformAbuseCasesResponse"
+          description: list platform abuse cases succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform abuse cases
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.abuse.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform abuse cases
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/abuse-cases/{commentId}:
+    get:
+      description: |
+        Operators only, with recent authentication. Reads one cross-platform
+        moderation case by stable comment id, including the comment body,
+        content and parent coordinates, and sorted distinct reasons from open
+        reports. Reporter identities and report notes are never exposed.
+      operationId: getPlatformAbuseCasesByCommentId
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: 018f0000-0000-7000-8000-000000000001
+          in: path
+          name: commentId
+          required: true
+          schema:
+            format: uuid
+            pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    body: Great article.
+                    commentId: 018f0000-0000-7000-8000-000000000003
+                    commentState: VISIBLE_PENDING_SCAN
+                    contentId: 018f0000-0000-7000-8000-000000000004
+                    firstReportedAt: "2026-10-10T10:30:00.000Z"
+                    lastReportedAt: "2026-10-10T11:00:00.000Z"
+                    openReportCount: 1
+                    organizationId: 018f0000-0000-7000-8000-000000000001
+                    parentId: null
+                    publicationId: 018f0000-0000-7000-8000-000000000002
+                    reportReasons:
+                      - OTHER
+                    totalReportCount: 1
+                    updatedAt: "2026-10-10T11:00:00.000Z"
+              schema:
+                $ref: "#/components/schemas/GetPlatformAbuseCasesByCommentIdResponse"
+          description: read platform abuse case succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+      security:
+        - browserSession: []
+      summary: read platform abuse case
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.abuse.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: read platform abuse case
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - RESOURCE_NOT_FOUND
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/abuse-cases/{commentId}:decide:
+    post:
+      description: |
+        Operators only, with recent authentication. Applies one existing
+        `ModerationDecision` after rechecking the comment and appeal state.
+        Inapplicable decisions return `INVALID_DECISION`. `reason` is the
+        non-sensitive operator reason code recorded in the audit event.
+      operationId: postPlatformAbuseCasesByCommentIdDecide
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: 018f0000-0000-7000-8000-000000000001
+          in: path
+          name: commentId
+          required: true
+          schema:
+            format: uuid
+            pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+            type: string
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  decision: HOLD
+                  note: Pending a second review.
+                  reason: REPORTED_CONTENT_REVIEW
+            schema:
+              $ref: "#/components/schemas/PostPlatformAbuseCasesByCommentIdDecideRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    body: Great article.
+                    commentId: 018f0000-0000-7000-8000-000000000003
+                    commentState: HELD_REVIEW
+                    contentId: 018f0000-0000-7000-8000-000000000004
+                    firstReportedAt: "2026-10-10T10:30:00.000Z"
+                    lastReportedAt: "2026-10-10T11:00:00.000Z"
+                    openReportCount: 1
+                    organizationId: 018f0000-0000-7000-8000-000000000001
+                    parentId: null
+                    publicationId: 018f0000-0000-7000-8000-000000000002
+                    reportReasons:
+                      - OTHER
+                    totalReportCount: 1
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+              schema:
+                $ref: "#/components/schemas/PostPlatformAbuseCasesByCommentIdDecideResponse"
+          description: decide platform abuse case succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+        "409":
+          $ref: "#/components/responses/InvalidDecisionCommandConflict"
+      security:
+        - browserSession: []
+      summary: decide platform abuse case
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.abuse.remediate
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: decide platform abuse case
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - INVALID_DECISION
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - RESOURCE_NOT_FOUND
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: protocol
+      x-gala-tenant-scope: NONE
   /v2/platform/adapters:
     get:
       description: |
@@ -45682,7 +47386,8 @@ paths:
         Operators only (a configured platform operator with recent
         authentication). Audit events across every organization, newest first,
         filtered by any combination of organization, publication, actor, action
-        and time window (`from` inclusive, `to` exclusive).
+        and time window (`from` inclusive, `to` exclusive). The operator App
+        supplies the trailing seven days when the URL has no explicit range.
       operationId: getPlatformAuditEvents
       parameters:
         - $ref: "#/components/parameters/XCorrelationId"
@@ -45889,6 +47594,167 @@ paths:
         - NONE
       x-gala-success-category: query
       x-gala-tenant-scope: NONE
+  /v2/platform/caches:
+    get:
+      description: |
+        Operators only, with recent authentication. Lists the bounded cache
+        inventory, each durable all-instance eviction epoch, this serving
+        instance's entry count, and update version. Cache keys and values are
+        never exposed.
+      operationId: getPlatformCaches
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    items:
+                      - epoch: 3
+                        localEntryCount: 7
+                        name: GITHUB_INSTALLATION_TOKEN
+                        ttlSeconds: 300
+                        updatedAt: "2026-10-10T12:00:00.000Z"
+                        updatedByPersonId: 018f0000-0000-7000-8000-000000000001
+                        version: 3
+              schema:
+                $ref: "#/components/schemas/GetPlatformCachesResponse"
+          description: list platform caches succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform caches
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.caches.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform caches
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/caches/{cacheId}:evict:
+    post:
+      description: |
+        Operators only, with recent authentication. Advances the named cache's
+        durable epoch at the exact version in `If-Match`; all serving instances
+        converge on that epoch, while `localEntryCount` reports only the
+        responding instance. `reason` is the non-sensitive reason code recorded
+        in the audit event.
+      operationId: postPlatformCachesByCacheIdEvict
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: GITHUB_INSTALLATION_TOKEN
+          in: path
+          name: cacheId
+          required: true
+          schema:
+            enum:
+              - GITHUB_INSTALLATION_TOKEN
+              - GITHUB_REPOSITORY_METADATA
+              - GITHUB_REPOSITORY_CONTENT
+            type: string
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/IfMatch"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  reason: CREDENTIAL_ROTATION
+            schema:
+              $ref: "#/components/schemas/PostPlatformCachesByCacheIdEvictRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    epoch: 4
+                    localEntryCount: 0
+                    name: GITHUB_INSTALLATION_TOKEN
+                    ttlSeconds: 300
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+                    updatedByPersonId: 018f0000-0000-7000-8000-000000000001
+                    version: 4
+              schema:
+                $ref: "#/components/schemas/PostPlatformCachesByCacheIdEvictResponse"
+          description: evict platform cache succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            ETag:
+              $ref: "#/components/headers/ETag"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+        "409":
+          $ref: "#/components/responses/CommandReplayConflict"
+        "412":
+          $ref: "#/components/responses/StaleAggregateVersion"
+      security:
+        - browserSession: []
+      summary: evict platform cache
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.caches.manage
+      x-gala-concurrency: if-match-platform-cache-version
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: evict platform cache
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - RESOURCE_NOT_FOUND
+        - STALE_AGGREGATE_VERSION
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: update
+      x-gala-tenant-scope: NONE
   /v2/platform/configuration:
     get:
       description: |
@@ -46015,6 +47881,836 @@ paths:
         - NONE
       x-gala-success-category: query
       x-gala-tenant-scope: NONE
+  /v2/platform/oauth-clients:
+    get:
+      description: |
+        Operators only, with recent authentication. Lists OAuth client registry
+        metadata. Client secrets are never returned by this or any later read.
+      operationId: getPlatformOauthClients
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    items:
+                      - accessTokenTtlSeconds: 3600
+                        clientId: gala_0123456789abcdefghijklmnopqrstuv
+                        clientType: CONFIDENTIAL
+                        createdAt: "2026-10-10T12:00:00.000Z"
+                        createdByPersonId: 018f0000-0000-7000-8000-000000000002
+                        description: Connect automation and monitoring tools.
+                        grantTypes:
+                          - AUTHORIZATION_CODE
+                          - REFRESH_TOKEN
+                          - CLIENT_CREDENTIALS
+                        homepageUri: https://example.com/
+                        id: 018f0000-0000-7000-8000-000000000001
+                        logoUri: https://example.com/logo.png
+                        name: Automation client
+                        redirectUris:
+                          - https://example.com/oauth/callback
+                        revokedAt: null
+                        scopes:
+                          - read
+                          - write
+                        state: DRAFT
+                        updatedAt: "2026-10-10T12:00:00.000Z"
+                        version: 0
+              schema:
+                $ref: "#/components/schemas/GetPlatformOauthClientsResponse"
+          description: list OAuth clients succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list OAuth clients
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.oauth.clients.manage
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list OAuth clients
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+    post:
+      description: |
+        Operators only, with recent authentication. Registers one DRAFT OAuth
+        client. `reason` is a non-sensitive operator reason code recorded in
+        the audit event. `Idempotency-Key` is the registry-row identity. The
+        generated CONFIDENTIAL-client secret is disclosed only by the first
+        successful response and is never stored in plaintext; PUBLIC clients
+        and committed retries return `clientSecret` null or omitted.
+      operationId: postPlatformOauthClients
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  accessTokenTtlSeconds: 3600
+                  clientType: CONFIDENTIAL
+                  description: Connect automation and monitoring tools.
+                  grantTypes:
+                    - AUTHORIZATION_CODE
+                    - REFRESH_TOKEN
+                    - CLIENT_CREDENTIALS
+                  homepageUri: https://example.com/
+                  logoUri: https://example.com/logo.png
+                  name: Automation client
+                  reason: OPERATOR_REQUESTED
+                  redirectUris:
+                    - https://example.com/oauth/callback
+                  scopes:
+                    - read
+                    - write
+            schema:
+              $ref: "#/components/schemas/PostPlatformOauthClientsRequest"
+        required: true
+      responses:
+        "201":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    client:
+                      accessTokenTtlSeconds: 3600
+                      clientId: gala_0123456789abcdefghijklmnopqrstuv
+                      clientType: CONFIDENTIAL
+                      createdAt: "2026-10-10T12:00:00.000Z"
+                      createdByPersonId: 018f0000-0000-7000-8000-000000000002
+                      description: Connect automation and monitoring tools.
+                      grantTypes:
+                        - AUTHORIZATION_CODE
+                        - REFRESH_TOKEN
+                        - CLIENT_CREDENTIALS
+                      homepageUri: https://example.com/
+                      id: 018f0000-0000-7000-8000-000000000001
+                      logoUri: https://example.com/logo.png
+                      name: Automation client
+                      redirectUris:
+                        - https://example.com/oauth/callback
+                      revokedAt: null
+                      scopes:
+                        - read
+                        - write
+                      state: DRAFT
+                      updatedAt: "2026-10-10T12:00:00.000Z"
+                      version: 0
+                    clientSecret: gala_secret_0123456789abcdefghijklmnopqrstuv
+              schema:
+                $ref: "#/components/schemas/PostPlatformOauthClientsResponse"
+          description: register OAuth client succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            Location:
+              $ref: "#/components/headers/Location"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "409":
+          $ref: "#/components/responses/CommandReplayConflict"
+      security:
+        - browserSession: []
+      summary: register OAuth client
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.oauth.clients.manage
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: register OAuth client
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: create
+      x-gala-tenant-scope: NONE
+  /v2/platform/oauth-clients/{oauthClientId}:revoke:
+    post:
+      description: |
+        Operators only, with recent authentication. Revokes exactly the DRAFT
+        registry entry named by `oauthClientId` (the entry's `id`, a UUID) at the
+        version in `If-Match`; the public OAuth `clientId` remains response
+        metadata. A REVOKED client is
+        rejected with `INVALID_SOURCE_STATE`. `reason` is the non-sensitive
+        reason code recorded in the audit event.
+      operationId: postPlatformOauthClientsByOauthClientIdRevoke
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: 018f0000-0000-7000-8000-000000000001
+          in: path
+          name: oauthClientId
+          required: true
+          schema:
+            format: uuid
+            pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+            type: string
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/IfMatch"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  reason: INTEGRATION_RETIRED
+            schema:
+              $ref: "#/components/schemas/PostPlatformOauthClientsByOauthClientIdRevokeRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    accessTokenTtlSeconds: 3600
+                    clientId: gala_0123456789abcdefghijklmnopqrstuv
+                    clientType: CONFIDENTIAL
+                    createdAt: "2026-10-10T12:00:00.000Z"
+                    createdByPersonId: 018f0000-0000-7000-8000-000000000002
+                    description: Connect automation and monitoring tools.
+                    grantTypes:
+                      - CLIENT_CREDENTIALS
+                    homepageUri: https://example.com/
+                    id: 018f0000-0000-7000-8000-000000000001
+                    logoUri: https://example.com/logo.png
+                    name: Automation client
+                    redirectUris: []
+                    revokedAt: "2026-10-10T13:00:00.000Z"
+                    scopes:
+                      - metrics:read
+                    state: REVOKED
+                    updatedAt: "2026-10-10T13:00:00.000Z"
+                    version: 1
+              schema:
+                $ref: "#/components/schemas/PostPlatformOauthClientsByOauthClientIdRevokeResponse"
+          description: revoke OAuth client succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            ETag:
+              $ref: "#/components/headers/ETag"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+        "409":
+          $ref: "#/components/responses/InvalidSourceStateCommandConflict"
+        "412":
+          $ref: "#/components/responses/StaleAggregateVersion"
+      security:
+        - browserSession: []
+      summary: revoke OAuth client
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.oauth.clients.manage
+      x-gala-concurrency: if-match-oauth-client-version
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: revoke OAuth client
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - INVALID_SOURCE_STATE
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - RESOURCE_NOT_FOUND
+        - STALE_AGGREGATE_VERSION
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - OAuthClient:DRAFT -> REVOKED
+      x-gala-success-category: update
+      x-gala-tenant-scope: NONE
+  /v2/platform/overview:
+    get:
+      description: |
+        Operators only, with recent authentication. A bounded platform summary
+        for the dashboard landing page. Counts use exact persisted person,
+        organization, publication, comment, reaction, OAuth client, abuse, and
+        webhook states. The webhook counters cover the trailing seven days;
+        no traffic or subscription fact is inferred.
+      operationId: getPlatformOverview
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    commentDeletedByAuthor: 1
+                    commentHeldReview: 2
+                    commentRemoved: 3
+                    commentVisible: 41
+                    commentVisibleFlagged: 4
+                    commentVisiblePendingScan: 2
+                    oauthClientDraft: 2
+                    oauthClientRevoked: 1
+                    openAbuseCases: 3
+                    organizationActive: 5
+                    organizationBusiness: 1
+                    organizationClosed: 0
+                    organizationClosing: 0
+                    organizationFree: 2
+                    organizationPro: 2
+                    organizationProvisioning: 1
+                    organizationSuspended: 0
+                    personActive: 8
+                    personClosed: 1
+                    personClosing: 0
+                    personRestricted: 1
+                    personSuspended: 1
+                    publicationActive: 12
+                    publicationPaused: 1
+                    publicationProvisioning: 1
+                    publicationRetired: 2
+                    publicationRetiring: 1
+                    reactionActive: 63
+                    reactionInactive: 4
+                    webhookProcessed7d: 25
+                    webhookProcessing7d: 1
+                    webhookQuarantined7d: 1
+                    webhookReceived7d: 2
+              schema:
+                $ref: "#/components/schemas/GetPlatformOverviewResponse"
+          description: read the platform dashboard overview succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: read the platform dashboard overview
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.users.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: read the platform dashboard overview
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/plans:
+    get:
+      description: |
+        Operators only, with recent authentication. Returns the complete,
+        active publication-capacity release with its single optimistic-lock
+        version and the closed FREE, PRO, and BUSINESS plan catalog.
+      operationId: getPlatformPlans
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    effectiveAt: "2026-10-10T00:00:04.000Z"
+                    items:
+                      - planKey: FREE
+                        publicationLimit: 1
+                      - planKey: PRO
+                        publicationLimit: 10
+                      - planKey: BUSINESS
+                        publicationLimit: 50
+                    releaseId: 019d0000-2000-7000-8000-000000000001
+                    releaseVersion: 2
+                    state: ACTIVE
+                    updatedAt: "2026-10-10T00:00:04.000Z"
+              schema:
+                $ref: "#/components/schemas/GetPlatformPlansResponse"
+          description: list platform plans succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform plans
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.plans.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform plans
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/plans/{planKey}:
+    put:
+      description: |
+        Operators only, with recent authentication. Atomically replaces the
+        complete publication-capacity release, changing the named plan's limit
+        while retaining the other two, at the release version in `If-Match`.
+        The invariant FREE <= PRO <= BUSINESS is enforced. `reason` is a
+        non-sensitive operator reason code recorded in the audit event.
+      operationId: putPlatformPlansByPlanKey
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: PRO
+          in: path
+          name: planKey
+          required: true
+          schema:
+            $ref: "#/components/schemas/PlatformPlanKey"
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/IfMatch"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  publicationLimit: 12
+                  reason: PLAN_LIMIT_UPDATE
+            schema:
+              $ref: "#/components/schemas/PutPlatformPlansByPlanKeyRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    effectiveAt: "2026-10-10T12:00:00.000Z"
+                    items:
+                      - planKey: FREE
+                        publicationLimit: 1
+                      - planKey: PRO
+                        publicationLimit: 12
+                      - planKey: BUSINESS
+                        publicationLimit: 50
+                    releaseId: 019d0000-2000-7000-8000-000000000002
+                    releaseVersion: 3
+                    state: ACTIVE
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+              schema:
+                $ref: "#/components/schemas/PutPlatformPlansByPlanKeyResponse"
+          description: update platform plan succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            ETag:
+              $ref: "#/components/headers/ETag"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+        "409":
+          $ref: "#/components/responses/CommandReplayConflict"
+        "412":
+          $ref: "#/components/responses/StaleAggregateVersion"
+      security:
+        - browserSession: []
+      summary: update platform plan
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.plans.manage
+      x-gala-concurrency: if-match-platform-plan-release-version
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: update platform plan
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - RESOURCE_NOT_FOUND
+        - STALE_AGGREGATE_VERSION
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: update
+      x-gala-tenant-scope: NONE
+  /v2/platform/users:
+    get:
+      description: |
+        Operators only, with recent authentication. Keyset-paged principals
+        across the platform with exact person state, provider display snapshots,
+        creation and last-sign-in instants, accessible publication count, and
+        the distinct organization plan tiers reached through current grants.
+        Subscription and per-user traffic data are not inferred.
+      operationId: getPlatformUsers
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - description: Only people in this exact persisted state.
+          example: ACTIVE
+          in: query
+          name: state
+          required: false
+          schema:
+            $ref: "#/components/schemas/PlatformPersonState"
+        - description: Case-insensitive match against person id, display name, or login.
+          example: ada
+          in: query
+          name: search
+          required: false
+          schema:
+            maxLength: 200
+            minLength: 1
+            type: string
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    hasMore: false
+                    items:
+                      - createdAt: "2026-09-01T12:00:00.000Z"
+                        displayName: Ada Reader
+                        lastSignInAt: "2026-10-10T11:30:00.000Z"
+                        login: ada-reader
+                        personId: 018f0000-0000-7000-8000-000000000001
+                        planTiers:
+                          - FREE
+                          - PRO
+                        publicationCount: 2
+                        state: ACTIVE
+                    nextCursor: null
+              schema:
+                $ref: "#/components/schemas/GetPlatformUsersResponse"
+          description: list platform users succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform users
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.users.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform users
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/webhook-events:
+    get:
+      description: |
+        Operators only, with recent authentication. Returns redacted GitHub
+        webhook inbox metadata, newest first. Bodies and payload digests are
+        never exposed. `from` is inclusive and `to` is exclusive; the operator
+        App supplies the trailing seven days when the URL has no explicit
+        range.
+      operationId: getPlatformWebhookEvents
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - description: Only events with this GitHub event type.
+          example: PUSH
+          in: query
+          name: eventType
+          required: false
+          schema:
+            $ref: "#/components/schemas/PlatformWebhookEventType"
+        - description: Only events in this processing state.
+          example: PROCESSED
+          in: query
+          name: status
+          required: false
+          schema:
+            $ref: "#/components/schemas/PlatformWebhookProcessingStatus"
+        - description: Only events first seen at or after this instant.
+          example: "2026-10-03T12:00:00.000Z"
+          in: query
+          name: from
+          required: false
+          schema:
+            description: "Canonical Gala instant: the UTC millisecond subset of RFC 3339, exactly `YYYY-MM-DDThh:mm:ss.sssZ`. Stated here rather than as a `pattern` because a generated `OffsetDateTime` cannot carry one (LOCAL-56)."
+            format: date-time
+            type: string
+        - description: Only events first seen before this instant.
+          example: "2026-10-10T12:00:00.000Z"
+          in: query
+          name: to
+          required: false
+          schema:
+            description: "Canonical Gala instant: the UTC millisecond subset of RFC 3339, exactly `YYYY-MM-DDThh:mm:ss.sssZ`. Stated here rather than as a `pattern` because a generated `OffsetDateTime` cannot carry one (LOCAL-56)."
+            format: date-time
+            type: string
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    hasMore: false
+                    items:
+                      - attemptCount: 1
+                        attemptLimit: 12
+                        eventId: 018f0000-0000-7000-8000-000000000001
+                        eventType: PUSH
+                        firstSeenAt: "2026-10-10T11:59:58.000Z"
+                        organizationId: 018f0000-0000-7000-8000-000000000003
+                        processedAt: "2026-10-10T12:00:00.000Z"
+                        providerRepositoryId: 123456789
+                        pullRequestNumber: null
+                        resultCode: APPLIED
+                        status: PROCESSED
+                        updatedAt: "2026-10-10T12:00:00.000Z"
+                        workflowRunId: null
+                    nextCursor: null
+              schema:
+                $ref: "#/components/schemas/GetPlatformWebhookEventsResponse"
+          description: list platform webhook events succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform webhook events
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.webhooks.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform webhook events
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/webhook-events/{eventId}:
+    get:
+      description: |
+        Operators only, with recent authentication. Reads one redacted webhook
+        inbox event by stable id. The request body and payload digest are never
+        exposed.
+      operationId: getPlatformWebhookEventsByEventId
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: 018f0000-0000-7000-8000-000000000001
+          in: path
+          name: eventId
+          required: true
+          schema:
+            format: uuid
+            pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    attemptCount: 1
+                    attemptLimit: 12
+                    eventId: 018f0000-0000-7000-8000-000000000001
+                    eventType: PUSH
+                    firstSeenAt: "2026-10-10T11:59:58.000Z"
+                    organizationId: 018f0000-0000-7000-8000-000000000003
+                    processedAt: "2026-10-10T12:00:00.000Z"
+                    providerRepositoryId: 123456789
+                    pullRequestNumber: null
+                    resultCode: APPLIED
+                    status: PROCESSED
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+                    workflowRunId: null
+              schema:
+                $ref: "#/components/schemas/GetPlatformWebhookEventsByEventIdResponse"
+          description: read platform webhook event succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+      security:
+        - browserSession: []
+      summary: read platform webhook event
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.webhooks.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: read platform webhook event
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - RESOURCE_NOT_FOUND
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
   /v2/public/comments/{commentId}:
     delete:
       description: A comment that has replies stays as a tombstone.