npm - @rathnasgala2/schemas - Versions diffs - 3.6.0 → 3.7.0 - Mend

@rathnasgala2/schemas 3.6.0 → 3.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/THIRD_PARTY_LICENSES.json +1 -1
package/docs/catalogs/app-components.json +1766 -2
package/docs/catalogs/app-routes.json +598 -1
package/docs/catalogs/schema-inventory.json +2 -2
package/openapi/http-catalog.json +170 -2
package/openapi/openapi.yaml +2670 -135
package/package.json +1 -1
package/sbom.cdx.json +23 -23

package/openapi/openapi.yaml CHANGED Viewed

@@ -141,6 +141,224 @@ components:
         minLength: 32
         type: string
   responses:
+    AuthorizationDenied:
+      content:
+        application/problem+json:
+          examples:
+            AUTHORIZATION_DENIED:
+              summary: AUTHORIZATION_DENIED
+              value:
+                code: AUTHORIZATION_DENIED
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 403
+                title: AUTHORIZATION_DENIED
+                type: urn:gala:problem:authorization-denied
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: AUTHORIZATION_DENIED
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - AUTHORIZATION_DENIED
+    CommandReplayConflict:
+      content:
+        application/problem+json:
+          examples:
+            COMMAND_REPLAY_CONFLICT:
+              summary: COMMAND_REPLAY_CONFLICT
+              value:
+                code: COMMAND_REPLAY_CONFLICT
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: COMMAND_REPLAY_CONFLICT
+                type: urn:gala:problem:command-replay-conflict
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: COMMAND_REPLAY_CONFLICT
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - COMMAND_REPLAY_CONFLICT
+    InvalidDecisionCommandConflict:
+      content:
+        application/problem+json:
+          examples:
+            COMMAND_REPLAY_CONFLICT:
+              summary: COMMAND_REPLAY_CONFLICT
+              value:
+                code: COMMAND_REPLAY_CONFLICT
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: COMMAND_REPLAY_CONFLICT
+                type: urn:gala:problem:command-replay-conflict
+            INVALID_DECISION:
+              summary: INVALID_DECISION
+              value:
+                code: INVALID_DECISION
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: INVALID_DECISION
+                type: urn:gala:problem:invalid-decision
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: COMMAND_REPLAY_CONFLICT, INVALID_DECISION
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - COMMAND_REPLAY_CONFLICT
+        - INVALID_DECISION
+    InvalidSourceStateCommandConflict:
+      content:
+        application/problem+json:
+          examples:
+            COMMAND_REPLAY_CONFLICT:
+              summary: COMMAND_REPLAY_CONFLICT
+              value:
+                code: COMMAND_REPLAY_CONFLICT
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: COMMAND_REPLAY_CONFLICT
+                type: urn:gala:problem:command-replay-conflict
+            INVALID_SOURCE_STATE:
+              summary: INVALID_SOURCE_STATE
+              value:
+                code: INVALID_SOURCE_STATE
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 409
+                title: INVALID_SOURCE_STATE
+                type: urn:gala:problem:invalid-source-state
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: COMMAND_REPLAY_CONFLICT, INVALID_SOURCE_STATE
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - COMMAND_REPLAY_CONFLICT
+        - INVALID_SOURCE_STATE
+    PlatformAuthenticationRequired:
+      content:
+        application/problem+json:
+          examples:
+            AUTHENTICATION_REQUIRED:
+              summary: AUTHENTICATION_REQUIRED
+              value:
+                code: AUTHENTICATION_REQUIRED
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 401
+                title: AUTHENTICATION_REQUIRED
+                type: urn:gala:problem:authentication-required
+            REAUTH_REQUIRED:
+              summary: REAUTH_REQUIRED
+              value:
+                code: REAUTH_REQUIRED
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 401
+                title: REAUTH_REQUIRED
+                type: urn:gala:problem:reauth-required
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: AUTHENTICATION_REQUIRED, REAUTH_REQUIRED
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - AUTHENTICATION_REQUIRED
+        - REAUTH_REQUIRED
+    RequestInvalid:
+      content:
+        application/problem+json:
+          examples:
+            REQUEST_FIELD_UNKNOWN:
+              summary: REQUEST_FIELD_UNKNOWN
+              value:
+                code: REQUEST_FIELD_UNKNOWN
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 400
+                title: REQUEST_FIELD_UNKNOWN
+                type: urn:gala:problem:request-field-unknown
+            VALIDATION_FAILED:
+              summary: VALIDATION_FAILED
+              value:
+                code: VALIDATION_FAILED
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 400
+                title: VALIDATION_FAILED
+                type: urn:gala:problem:validation-failed
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: REQUEST_FIELD_UNKNOWN, VALIDATION_FAILED
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - REQUEST_FIELD_UNKNOWN
+        - VALIDATION_FAILED
     RequestTooLarge:
       content:
         application/problem+json:
@@ -168,6 +386,60 @@ components:
           $ref: "#/components/headers/XCorrelationId"
       x-gala-problem-codes:
         - VALIDATION_FAILED
+    ResourceNotFound:
+      content:
+        application/problem+json:
+          examples:
+            RESOURCE_NOT_FOUND:
+              summary: RESOURCE_NOT_FOUND
+              value:
+                code: RESOURCE_NOT_FOUND
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 404
+                title: RESOURCE_NOT_FOUND
+                type: urn:gala:problem:resource-not-found
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: RESOURCE_NOT_FOUND
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - RESOURCE_NOT_FOUND
+    StaleAggregateVersion:
+      content:
+        application/problem+json:
+          examples:
+            STALE_AGGREGATE_VERSION:
+              summary: STALE_AGGREGATE_VERSION
+              value:
+                code: STALE_AGGREGATE_VERSION
+                correlationId: 018f0000-0000-7000-8000-000000000001
+                detail: See the operation contract.
+                errors: []
+                retryable: false
+                schemaId: urn:gala:schema:problem:2.0.0
+                schemaVersion: 2.0.0
+                status: 412
+                title: STALE_AGGREGATE_VERSION
+                type: urn:gala:problem:stale-aggregate-version
+          schema:
+            $ref: "#/components/schemas/Problem"
+      description: STALE_AGGREGATE_VERSION
+      headers:
+        Cache-Control:
+          $ref: "#/components/headers/CacheControlNoStore"
+        X-Correlation-Id:
+          $ref: "#/components/headers/XCorrelationId"
+      x-gala-problem-codes:
+        - STALE_AGGREGATE_VERSION
     UnsupportedMediaType:
       content:
         application/problem+json:
@@ -3234,19 +3506,9 @@ components:
         - items
         - hasMore
       type: object
-    GetPlatformAdaptersResponse:
-      additionalProperties: false
-      properties:
-        items:
-          items:
-            $ref: "#/components/schemas/PlatformAdapter"
-          maxItems: 100
-          minItems: 0
-          type: array
-      required:
-        - items
-      type: object
-    GetPlatformAuditEventsResponse:
+    GetPlatformAbuseCasesByCommentIdResponse:
+      $ref: "#/components/schemas/PlatformAbuseCaseDetail"
+    GetPlatformAbuseCasesResponse:
       additionalProperties: false
       allOf:
         - else:
@@ -3274,11 +3536,11 @@ components:
           type: boolean
         items:
           items:
-            $ref: "#/components/schemas/PlatformAuditEvent"
+            $ref: "#/components/schemas/PlatformAbuseCaseSummary"
           maxItems: 100
           type: array
         nextCursor:
-          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false. The length bounds constrain the string branch only.
+          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false.
           maxLength: 2048
           minLength: 1
           type:
@@ -3288,134 +3550,468 @@ components:
         - items
         - hasMore
       type: object
-    GetPlatformConfigurationResponse:
+    GetPlatformAdaptersResponse:
       additionalProperties: false
       properties:
-        families:
+        items:
           items:
-            additionalProperties: false
-            properties:
-              family:
-                maxLength: 80
-                minLength: 1
-                type: string
-              keys:
-                items:
-                  $ref: "#/components/schemas/PlatformConfigurationKey"
-                maxItems: 200
-                minItems: 0
-                type: array
-            required:
-              - family
-              - keys
-            type: object
+            $ref: "#/components/schemas/PlatformAdapter"
           maxItems: 100
           minItems: 0
           type: array
-      required:
-        - families
-      type: object
-    GetPublicPublicationsByPublicationIdContentsByContentIdCommentsResponse:
-      additionalProperties: false
-      properties:
-        count:
-          oneOf:
-            - $ref: "#/components/schemas/PublicCount"
-            - type: "null"
-        items:
-          items:
-            $ref: "#/components/schemas/CommentView"
-          maxItems: 50
-          type: array
-        nextCursor:
-          maxLength: 2048
-          minLength: 1
-          type:
-            - string
-            - "null"
       required:
         - items
-        - nextCursor
-        - count
-      type: object
-    GetPublicPublicationsByPublicationIdContentsByContentIdInteractionsResponse:
-      additionalProperties: false
-      properties:
-        asOf:
-          description: "Canonical Gala instant: the UTC millisecond subset of RFC 3339, exactly `YYYY-MM-DDThh:mm:ss.sssZ`. Stated here rather than as a `pattern` because a generated `OffsetDateTime` cannot carry one (LOCAL-56)."
-          format: date-time
-          type: string
-        comments:
-          additionalProperties: false
-          properties:
-            allowReplies:
-              type: boolean
-            enabled:
-              type: boolean
-            maxDepth:
-              maximum: 4
-              minimum: 1
-              type: integer
-            open:
-              type: boolean
-          required:
-            - enabled
-            - open
-            - allowReplies
-            - maxDepth
-          type: object
-        reactions:
-          additionalProperties: false
-          properties:
-            enabled:
-              type: boolean
-            items:
-              items:
-                $ref: "#/components/schemas/PublicReactionItem"
-              maxItems: 17
-              type: array
-          required:
-            - enabled
-            - items
-          type: object
-        viewer:
-          oneOf:
-            - $ref: "#/components/schemas/ReaderView"
-            - type: "null"
-      required:
-        - reactions
-        - comments
-        - viewer
-        - asOf
       type: object
-    GetPublicPublicationsByPublicationIdResponse:
-      additionalProperties: false
-      properties:
-        name:
-          maxLength: 120
-          minLength: 1
-          type: string
-        origin:
-          maxLength: 255
-          minLength: 1
-          pattern: ^(?:https://[^\s]+|http://(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?(?:/[^\s]*)?)$
-          type: string
-        publicBaseUrl:
-          maxLength: 2048
-          minLength: 1
-          pattern: ^(?:https://[^\s]+|http://(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?(?:/[^\s]*)?)$
-          type: string
-        publicationId:
-          format: uuid
-          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
-          type: string
-      required:
-        - publicationId
-        - name
-        - origin
-        - publicBaseUrl
-      type: object
-    GetSelfAuthenticatorsResponse:
+    GetPlatformAuditEventsResponse:
+      additionalProperties: false
+      allOf:
+        - else:
+            properties:
+              nextCursor:
+                type: "null"
+          if:
+            properties:
+              hasMore:
+                not:
+                  enum:
+                    - false
+                type: boolean
+                x-gala-const: true
+            required:
+              - hasMore
+          then:
+            properties:
+              nextCursor:
+                type: string
+            required:
+              - nextCursor
+      properties:
+        hasMore:
+          type: boolean
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformAuditEvent"
+          maxItems: 100
+          type: array
+        nextCursor:
+          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false. The length bounds constrain the string branch only.
+          maxLength: 2048
+          minLength: 1
+          type:
+            - string
+            - "null"
+      required:
+        - items
+        - hasMore
+      type: object
+    GetPlatformCachesResponse:
+      additionalProperties: false
+      properties:
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformCache"
+          maxItems: 100
+          type: array
+      required:
+        - items
+      type: object
+    GetPlatformConfigurationResponse:
+      additionalProperties: false
+      properties:
+        families:
+          items:
+            additionalProperties: false
+            properties:
+              family:
+                maxLength: 80
+                minLength: 1
+                type: string
+              keys:
+                items:
+                  $ref: "#/components/schemas/PlatformConfigurationKey"
+                maxItems: 200
+                minItems: 0
+                type: array
+            required:
+              - family
+              - keys
+            type: object
+          maxItems: 100
+          minItems: 0
+          type: array
+      required:
+        - families
+      type: object
+    GetPlatformOauthClientsResponse:
+      additionalProperties: false
+      properties:
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformOauthClient"
+          maxItems: 500
+          type: array
+      required:
+        - items
+      type: object
+    GetPlatformOverviewResponse:
+      additionalProperties: false
+      properties:
+        commentDeletedByAuthor:
+          format: int64
+          minimum: 0
+          type: integer
+        commentHeldReview:
+          format: int64
+          minimum: 0
+          type: integer
+        commentRemoved:
+          format: int64
+          minimum: 0
+          type: integer
+        commentVisible:
+          format: int64
+          minimum: 0
+          type: integer
+        commentVisibleFlagged:
+          format: int64
+          minimum: 0
+          type: integer
+        commentVisiblePendingScan:
+          format: int64
+          minimum: 0
+          type: integer
+        oauthClientDraft:
+          format: int64
+          minimum: 0
+          type: integer
+        oauthClientRevoked:
+          format: int64
+          minimum: 0
+          type: integer
+        openAbuseCases:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationActive:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationBusiness:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationClosed:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationClosing:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationFree:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationPro:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationProvisioning:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationSuspended:
+          format: int64
+          minimum: 0
+          type: integer
+        personActive:
+          format: int64
+          minimum: 0
+          type: integer
+        personClosed:
+          format: int64
+          minimum: 0
+          type: integer
+        personClosing:
+          format: int64
+          minimum: 0
+          type: integer
+        personRestricted:
+          format: int64
+          minimum: 0
+          type: integer
+        personSuspended:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationActive:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationPaused:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationProvisioning:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationRetired:
+          format: int64
+          minimum: 0
+          type: integer
+        publicationRetiring:
+          format: int64
+          minimum: 0
+          type: integer
+        reactionActive:
+          format: int64
+          minimum: 0
+          type: integer
+        reactionInactive:
+          format: int64
+          minimum: 0
+          type: integer
+        webhookProcessed7d:
+          format: int64
+          minimum: 0
+          type: integer
+        webhookProcessing7d:
+          format: int64
+          minimum: 0
+          type: integer
+        webhookQuarantined7d:
+          format: int64
+          minimum: 0
+          type: integer
+        webhookReceived7d:
+          format: int64
+          minimum: 0
+          type: integer
+      required:
+        - personActive
+        - personSuspended
+        - personRestricted
+        - personClosing
+        - personClosed
+        - organizationProvisioning
+        - organizationActive
+        - organizationSuspended
+        - organizationClosing
+        - organizationClosed
+        - organizationFree
+        - organizationPro
+        - organizationBusiness
+        - publicationProvisioning
+        - publicationActive
+        - publicationPaused
+        - publicationRetiring
+        - publicationRetired
+        - commentVisiblePendingScan
+        - commentVisible
+        - commentVisibleFlagged
+        - commentHeldReview
+        - commentRemoved
+        - commentDeletedByAuthor
+        - reactionActive
+        - reactionInactive
+        - oauthClientDraft
+        - oauthClientRevoked
+        - openAbuseCases
+        - webhookReceived7d
+        - webhookProcessing7d
+        - webhookProcessed7d
+        - webhookQuarantined7d
+      type: object
+    GetPlatformPlansResponse:
+      $ref: "#/components/schemas/PlatformPlanCapacityRelease"
+    GetPlatformUsersResponse:
+      additionalProperties: false
+      allOf:
+        - else:
+            properties:
+              nextCursor:
+                type: "null"
+          if:
+            properties:
+              hasMore:
+                not:
+                  enum:
+                    - false
+                type: boolean
+                x-gala-const: true
+            required:
+              - hasMore
+          then:
+            properties:
+              nextCursor:
+                type: string
+            required:
+              - nextCursor
+      properties:
+        hasMore:
+          type: boolean
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformUser"
+          maxItems: 100
+          type: array
+        nextCursor:
+          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false.
+          maxLength: 2048
+          minLength: 1
+          type:
+            - string
+            - "null"
+      required:
+        - items
+        - hasMore
+      type: object
+    GetPlatformWebhookEventsByEventIdResponse:
+      $ref: "#/components/schemas/PlatformWebhookEvent"
+    GetPlatformWebhookEventsResponse:
+      additionalProperties: false
+      allOf:
+        - else:
+            properties:
+              nextCursor:
+                type: "null"
+          if:
+            properties:
+              hasMore:
+                not:
+                  enum:
+                    - false
+                type: boolean
+                x-gala-const: true
+            required:
+              - hasMore
+          then:
+            properties:
+              nextCursor:
+                type: string
+            required:
+              - nextCursor
+      properties:
+        hasMore:
+          type: boolean
+        items:
+          items:
+            $ref: "#/components/schemas/PlatformWebhookEvent"
+          maxItems: 100
+          type: array
+        nextCursor:
+          description: Opaque cursor for the next page. Present and non-null exactly when `hasMore` is true; absent or null when `hasMore` is false.
+          maxLength: 2048
+          minLength: 1
+          type:
+            - string
+            - "null"
+      required:
+        - items
+        - hasMore
+      type: object
+    GetPublicPublicationsByPublicationIdContentsByContentIdCommentsResponse:
+      additionalProperties: false
+      properties:
+        count:
+          oneOf:
+            - $ref: "#/components/schemas/PublicCount"
+            - type: "null"
+        items:
+          items:
+            $ref: "#/components/schemas/CommentView"
+          maxItems: 50
+          type: array
+        nextCursor:
+          maxLength: 2048
+          minLength: 1
+          type:
+            - string
+            - "null"
+      required:
+        - items
+        - nextCursor
+        - count
+      type: object
+    GetPublicPublicationsByPublicationIdContentsByContentIdInteractionsResponse:
+      additionalProperties: false
+      properties:
+        asOf:
+          description: "Canonical Gala instant: the UTC millisecond subset of RFC 3339, exactly `YYYY-MM-DDThh:mm:ss.sssZ`. Stated here rather than as a `pattern` because a generated `OffsetDateTime` cannot carry one (LOCAL-56)."
+          format: date-time
+          type: string
+        comments:
+          additionalProperties: false
+          properties:
+            allowReplies:
+              type: boolean
+            enabled:
+              type: boolean
+            maxDepth:
+              maximum: 4
+              minimum: 1
+              type: integer
+            open:
+              type: boolean
+          required:
+            - enabled
+            - open
+            - allowReplies
+            - maxDepth
+          type: object
+        reactions:
+          additionalProperties: false
+          properties:
+            enabled:
+              type: boolean
+            items:
+              items:
+                $ref: "#/components/schemas/PublicReactionItem"
+              maxItems: 17
+              type: array
+          required:
+            - enabled
+            - items
+          type: object
+        viewer:
+          oneOf:
+            - $ref: "#/components/schemas/ReaderView"
+            - type: "null"
+      required:
+        - reactions
+        - comments
+        - viewer
+        - asOf
+      type: object
+    GetPublicPublicationsByPublicationIdResponse:
+      additionalProperties: false
+      properties:
+        name:
+          maxLength: 120
+          minLength: 1
+          type: string
+        origin:
+          maxLength: 255
+          minLength: 1
+          pattern: ^(?:https://[^\s]+|http://(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?(?:/[^\s]*)?)$
+          type: string
+        publicBaseUrl:
+          maxLength: 2048
+          minLength: 1
+          pattern: ^(?:https://[^\s]+|http://(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?(?:/[^\s]*)?)$
+          type: string
+        publicationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+      required:
+        - publicationId
+        - name
+        - origin
+        - publicBaseUrl
+      type: object
+    GetSelfAuthenticatorsResponse:
       additionalProperties: false
       allOf:
         - else:
@@ -5771,6 +6367,114 @@ components:
         - label
         - createdAt
       type: object
+    PlatformAbuseCaseDetail:
+      additionalProperties: false
+      description: Review evidence for one abuse case. Report reasons include only open reports and are sorted and distinct; reporter identities and notes are never exposed.
+      properties:
+        body:
+          maxLength: 20000
+          type: string
+        commentId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        commentState:
+          $ref: "#/components/schemas/CommentInternalState"
+        contentId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        firstReportedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        lastReportedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        openReportCount:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        parentId:
+          oneOf:
+            - format: uuid
+              pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+              type: string
+            - type: "null"
+        publicationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        reportReasons:
+          items:
+            $ref: "#/components/schemas/ReaderReportReason"
+          maxItems: 8
+          type: array
+          uniqueItems: true
+        totalReportCount:
+          format: int64
+          minimum: 0
+          type: integer
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+      required:
+        - commentId
+        - organizationId
+        - publicationId
+        - commentState
+        - openReportCount
+        - totalReportCount
+        - firstReportedAt
+        - lastReportedAt
+        - updatedAt
+        - body
+        - contentId
+        - parentId
+        - reportReasons
+      type: object
+    PlatformAbuseCaseSummary:
+      additionalProperties: false
+      properties:
+        commentId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        commentState:
+          $ref: "#/components/schemas/CommentInternalState"
+        firstReportedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        lastReportedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        openReportCount:
+          format: int64
+          minimum: 0
+          type: integer
+        organizationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        publicationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        totalReportCount:
+          format: int64
+          minimum: 0
+          type: integer
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+      required:
+        - commentId
+        - organizationId
+        - publicationId
+        - commentState
+        - openReportCount
+        - totalReportCount
+        - firstReportedAt
+        - lastReportedAt
+        - updatedAt
+      type: object
     PlatformAdapter:
       additionalProperties: false
       description: One admitted adapter (publish toolchain release or provider adapter). Today every admitted row reads `ADMITTED`; `SUSPENDED` and `SUPERSEDED` are reserved for the suspend/restore and supersession flows.
@@ -5871,6 +6575,49 @@ components:
         - outcomeCode
         - correlationId
       type: object
+    PlatformCache:
+      additionalProperties: false
+      properties:
+        epoch:
+          format: int64
+          minimum: 0
+          type: integer
+        localEntryCount:
+          format: int64
+          minimum: 0
+          type: integer
+        name:
+          enum:
+            - GITHUB_INSTALLATION_TOKEN
+            - GITHUB_REPOSITORY_METADATA
+            - GITHUB_REPOSITORY_CONTENT
+          type: string
+        ttlSeconds:
+          format: int64
+          minimum: 1
+          type: integer
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        updatedByPersonId:
+          description: The last evicting operator, or null before the cache's first eviction.
+          oneOf:
+            - format: uuid
+              pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+              type: string
+            - type: "null"
+        version:
+          format: int64
+          minimum: 0
+          type: integer
+      required:
+        - name
+        - epoch
+        - localEntryCount
+        - ttlSeconds
+        - updatedByPersonId
+        - updatedAt
+        - version
+      type: object
     PlatformConfigurationKey:
       additionalProperties: false
       description: One configuration value as canonical text (`20`, `false`, `PT5M`); `source` says whether it is the compiled catalog default or an environment override.
@@ -5919,6 +6666,361 @@ components:
         - source
         - description
       type: object
+    PlatformOauthClient:
+      additionalProperties: false
+      properties:
+        accessTokenTtlSeconds:
+          maximum: 86400
+          minimum: 300
+          type: integer
+        clientId:
+          maxLength: 160
+          minLength: 24
+          pattern: ^[A-Za-z0-9._~-]+$
+          type: string
+        clientType:
+          $ref: "#/components/schemas/PlatformOauthClientType"
+        createdAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        createdByPersonId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        description:
+          oneOf:
+            - $ref: "#/components/schemas/PlatformOauthClientDescriptionText"
+            - type: "null"
+        grantTypes:
+          items:
+            $ref: "#/components/schemas/PlatformOauthGrantType"
+          maxItems: 3
+          minItems: 1
+          type: array
+          uniqueItems: true
+        homepageUri:
+          oneOf:
+            - $ref: "#/components/schemas/PlatformOauthClientHttpsUri"
+            - type: "null"
+        id:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        logoUri:
+          oneOf:
+            - $ref: "#/components/schemas/PlatformOauthClientHttpsUri"
+            - type: "null"
+        name:
+          maxLength: 120
+          minLength: 1
+          type: string
+        redirectUris:
+          items:
+            format: uri
+            maxLength: 2048
+            minLength: 8
+            pattern: ^(?:https://[^/\s#]+/|http://(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?/)[^\s#]*$
+            type: string
+          maxItems: 20
+          type: array
+          uniqueItems: true
+        revokedAt:
+          oneOf:
+            - $ref: "#/components/schemas/PortableProblemRfc3339"
+            - type: "null"
+        scopes:
+          items:
+            $ref: "#/components/schemas/PlatformOauthScope"
+          maxItems: 3
+          minItems: 1
+          type: array
+          uniqueItems: true
+        state:
+          enum:
+            - DRAFT
+            - REVOKED
+          type: string
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        version:
+          format: int64
+          minimum: 0
+          type: integer
+      required:
+        - id
+        - clientId
+        - name
+        - description
+        - clientType
+        - grantTypes
+        - redirectUris
+        - scopes
+        - accessTokenTtlSeconds
+        - logoUri
+        - homepageUri
+        - state
+        - createdByPersonId
+        - createdAt
+        - updatedAt
+        - revokedAt
+        - version
+      type: object
+    PlatformOauthClientDescriptionText:
+      maxLength: 1000
+      minLength: 1
+      type: string
+    PlatformOauthClientHttpsUri:
+      format: uri
+      maxLength: 2048
+      minLength: 8
+      pattern: ^https://[^\s#]+$
+      type: string
+    PlatformOauthClientType:
+      enum:
+        - PUBLIC
+        - CONFIDENTIAL
+      type: string
+    PlatformOauthGrantType:
+      enum:
+        - AUTHORIZATION_CODE
+        - REFRESH_TOKEN
+        - CLIENT_CREDENTIALS
+      type: string
+    PlatformOauthScope:
+      enum:
+        - read
+        - write
+        - metrics:read
+      type: string
+    PlatformOperatorReasonCode:
+      description: Non-sensitive operator reason code recorded in the audit event.
+      maxLength: 80
+      minLength: 1
+      pattern: ^[A-Z][A-Z0-9_]{0,79}$
+      type: string
+    PlatformPersonState:
+      enum:
+        - ACTIVE
+        - SUSPENDED
+        - RESTRICTED
+        - CLOSING
+        - CLOSED
+      type: string
+    PlatformPlan:
+      additionalProperties: false
+      properties:
+        planKey:
+          $ref: "#/components/schemas/PlatformPlanKey"
+        publicationLimit:
+          format: int64
+          minimum: 1
+          type: integer
+      required:
+        - planKey
+        - publicationLimit
+      type: object
+    PlatformPlanCapacityRelease:
+      additionalProperties: false
+      properties:
+        effectiveAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        items:
+          allOf:
+            - contains:
+                properties:
+                  planKey:
+                    pattern: ^FREE$
+                    type: string
+                    x-gala-const: FREE
+                required:
+                  - planKey
+                type: object
+              maxContains: 1
+              minContains: 1
+            - contains:
+                properties:
+                  planKey:
+                    pattern: ^PRO$
+                    type: string
+                    x-gala-const: PRO
+                required:
+                  - planKey
+                type: object
+              maxContains: 1
+              minContains: 1
+            - contains:
+                properties:
+                  planKey:
+                    pattern: ^BUSINESS$
+                    type: string
+                    x-gala-const: BUSINESS
+                required:
+                  - planKey
+                type: object
+              maxContains: 1
+              minContains: 1
+          items:
+            $ref: "#/components/schemas/PlatformPlan"
+          maxItems: 3
+          minItems: 3
+          type: array
+        releaseId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        releaseVersion:
+          format: int64
+          minimum: 1
+          type: integer
+        state:
+          pattern: ^ACTIVE$
+          type: string
+          x-gala-const: ACTIVE
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+      required:
+        - releaseId
+        - releaseVersion
+        - state
+        - effectiveAt
+        - updatedAt
+        - items
+      type: object
+    PlatformPlanKey:
+      enum:
+        - FREE
+        - PRO
+        - BUSINESS
+      type: string
+    PlatformUser:
+      additionalProperties: false
+      properties:
+        createdAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        displayName:
+          maxLength: 255
+          type:
+            - string
+            - "null"
+        lastSignInAt:
+          oneOf:
+            - $ref: "#/components/schemas/PortableProblemRfc3339"
+            - type: "null"
+        login:
+          maxLength: 80
+          minLength: 1
+          type:
+            - string
+            - "null"
+        personId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        planTiers:
+          items:
+            $ref: "#/components/schemas/PlatformPlanKey"
+          maxItems: 3
+          type: array
+          uniqueItems: true
+        publicationCount:
+          format: int64
+          minimum: 0
+          type: integer
+        state:
+          $ref: "#/components/schemas/PlatformPersonState"
+      required:
+        - personId
+        - state
+        - displayName
+        - login
+        - createdAt
+        - lastSignInAt
+        - publicationCount
+        - planTiers
+      type: object
+    PlatformWebhookEvent:
+      additionalProperties: false
+      description: Redacted webhook inbox metadata and immutable routing coordinates. The request body and payload digest are deliberately never exposed.
+      properties:
+        attemptCount:
+          minimum: 0
+          type: integer
+        attemptLimit:
+          minimum: 1
+          type: integer
+        eventId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        eventType:
+          $ref: "#/components/schemas/PlatformWebhookEventType"
+        firstSeenAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        organizationId:
+          format: uuid
+          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+          type: string
+        processedAt:
+          oneOf:
+            - $ref: "#/components/schemas/PortableProblemRfc3339"
+            - type: "null"
+        providerRepositoryId:
+          format: int64
+          minimum: 1
+          type:
+            - integer
+            - "null"
+        pullRequestNumber:
+          format: int64
+          minimum: 1
+          type:
+            - integer
+            - "null"
+        resultCode:
+          maxLength: 120
+          minLength: 1
+          pattern: ^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$
+          type:
+            - string
+            - "null"
+        status:
+          $ref: "#/components/schemas/PlatformWebhookProcessingStatus"
+        updatedAt:
+          $ref: "#/components/schemas/PortableProblemRfc3339"
+        workflowRunId:
+          format: int64
+          minimum: 1
+          type:
+            - integer
+            - "null"
+      required:
+        - eventId
+        - organizationId
+        - eventType
+        - status
+        - providerRepositoryId
+        - pullRequestNumber
+        - workflowRunId
+        - attemptCount
+        - attemptLimit
+        - resultCode
+        - firstSeenAt
+        - processedAt
+        - updatedAt
+      type: object
+    PlatformWebhookEventType:
+      enum:
+        - PULL_REQUEST
+        - PUSH
+        - WORKFLOW_RUN
+        - OTHER
+      type: string
+    PlatformWebhookProcessingStatus:
+      enum:
+        - RECEIVED
+        - PROCESSING
+        - PROCESSED
+        - QUARANTINED
+      type: string
     PortableAppearanceAttribution:
       additionalProperties: false
       description: 'Footer attribution. `showMadeWith: false` omits the "Made with Galascribe" mark; an absent `attribution` means it is shown.'
@@ -13520,6 +14622,180 @@ components:
         - name
         - slug
       type: object
+    PostPlatformAbuseCasesByCommentIdDecideRequest:
+      additionalProperties: false
+      properties:
+        decision:
+          $ref: "#/components/schemas/ModerationDecision"
+        note:
+          maxLength: 1000
+          type:
+            - string
+            - "null"
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+      required:
+        - decision
+        - note
+        - reason
+      type: object
+    PostPlatformAbuseCasesByCommentIdDecideResponse:
+      $ref: "#/components/schemas/PlatformAbuseCaseDetail"
+    PostPlatformCachesByCacheIdEvictRequest:
+      additionalProperties: false
+      properties:
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+      required:
+        - reason
+      type: object
+    PostPlatformCachesByCacheIdEvictResponse:
+      $ref: "#/components/schemas/PlatformCache"
+    PostPlatformOauthClientsByOauthClientIdRevokeRequest:
+      additionalProperties: false
+      properties:
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+      required:
+        - reason
+      type: object
+    PostPlatformOauthClientsByOauthClientIdRevokeResponse:
+      $ref: "#/components/schemas/PlatformOauthClient"
+    PostPlatformOauthClientsRequest:
+      additionalProperties: false
+      allOf:
+        - else:
+            properties:
+              redirectUris:
+                maxItems: 0
+          if:
+            properties:
+              grantTypes:
+                contains:
+                  pattern: ^AUTHORIZATION_CODE$
+                  type: string
+                  x-gala-const: AUTHORIZATION_CODE
+            required:
+              - grantTypes
+          then:
+            properties:
+              redirectUris:
+                minItems: 1
+        - if:
+            properties:
+              grantTypes:
+                contains:
+                  pattern: ^REFRESH_TOKEN$
+                  type: string
+                  x-gala-const: REFRESH_TOKEN
+            required:
+              - grantTypes
+          then:
+            properties:
+              grantTypes:
+                contains:
+                  pattern: ^AUTHORIZATION_CODE$
+                  type: string
+                  x-gala-const: AUTHORIZATION_CODE
+        - if:
+            properties:
+              clientType:
+                pattern: ^PUBLIC$
+                type: string
+                x-gala-const: PUBLIC
+            required:
+              - clientType
+          then:
+            properties:
+              grantTypes:
+                not:
+                  contains:
+                    pattern: ^CLIENT_CREDENTIALS$
+                    type: string
+                    x-gala-const: CLIENT_CREDENTIALS
+      properties:
+        accessTokenTtlSeconds:
+          maximum: 86400
+          minimum: 300
+          type: integer
+        clientType:
+          $ref: "#/components/schemas/PlatformOauthClientType"
+        description:
+          maxLength: 1000
+          minLength: 1
+          type:
+            - string
+            - "null"
+        grantTypes:
+          items:
+            $ref: "#/components/schemas/PlatformOauthGrantType"
+          maxItems: 3
+          minItems: 1
+          type: array
+          uniqueItems: true
+        homepageUri:
+          format: uri
+          maxLength: 2048
+          minLength: 8
+          pattern: ^https://[^\s#]+$
+          type:
+            - string
+            - "null"
+        logoUri:
+          format: uri
+          maxLength: 2048
+          minLength: 8
+          pattern: ^https://[^\s#]+$
+          type:
+            - string
+            - "null"
+        name:
+          maxLength: 120
+          minLength: 1
+          type: string
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+        redirectUris:
+          items:
+            format: uri
+            maxLength: 2048
+            minLength: 8
+            pattern: ^(?:https://[^/\s#]+/|http://(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?/)[^\s#]*$
+            type: string
+          maxItems: 20
+          type: array
+          uniqueItems: true
+        scopes:
+          items:
+            $ref: "#/components/schemas/PlatformOauthScope"
+          maxItems: 3
+          minItems: 1
+          type: array
+          uniqueItems: true
+      required:
+        - name
+        - clientType
+        - grantTypes
+        - redirectUris
+        - scopes
+        - accessTokenTtlSeconds
+        - reason
+      type: object
+    PostPlatformOauthClientsResponse:
+      additionalProperties: false
+      description: A CONFIDENTIAL client's secret is disclosed only by the first successful create response. PUBLIC clients and committed idempotent retries return `clientSecret` null or omitted because plaintext secrets are not stored. It is never returned by a later read.
+      properties:
+        client:
+          $ref: "#/components/schemas/PlatformOauthClient"
+        clientSecret:
+          maxLength: 512
+          minLength: 32
+          type:
+            - string
+            - "null"
+      required:
+        - client
+      type: object
     PostPublicCommentsByCommentIdAppealsRequest:
       additionalProperties: false
       properties:
@@ -15022,6 +16298,21 @@ components:
       required:
         - change
       type: object
+    PutPlatformPlansByPlanKeyRequest:
+      additionalProperties: false
+      properties:
+        publicationLimit:
+          format: int64
+          minimum: 1
+          type: integer
+        reason:
+          $ref: "#/components/schemas/PlatformOperatorReasonCode"
+      required:
+        - publicationLimit
+        - reason
+      type: object
+    PutPlatformPlansByPlanKeyResponse:
+      $ref: "#/components/schemas/PlatformPlanCapacityRelease"
     PutPublicPublicationsByPublicationIdContentsByContentIdReactionsByReactionKeyResponse:
       additionalProperties: false
       properties:
@@ -45718,6 +47009,258 @@ paths:
         - NONE
       x-gala-success-category: query
       x-gala-tenant-scope: ORGANIZATION_PATH
+  /v2/platform/abuse-cases:
+    get:
+      description: |
+        Operators only, with recent authentication. Keyset-paged moderation
+        cases across every organization. Rows expose only identifiers, state,
+        report counts, and ordering instants; comment bodies and report reasons
+        are available only from the detail operation.
+      operationId: getPlatformAbuseCases
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    hasMore: false
+                    items:
+                      - commentId: 018f0000-0000-7000-8000-000000000003
+                        commentState: VISIBLE_PENDING_SCAN
+                        firstReportedAt: "2026-10-10T10:30:00.000Z"
+                        lastReportedAt: "2026-10-10T11:00:00.000Z"
+                        openReportCount: 1
+                        organizationId: 018f0000-0000-7000-8000-000000000001
+                        publicationId: 018f0000-0000-7000-8000-000000000002
+                        totalReportCount: 1
+                        updatedAt: "2026-10-10T11:00:00.000Z"
+                    nextCursor: null
+              schema:
+                $ref: "#/components/schemas/GetPlatformAbuseCasesResponse"
+          description: list platform abuse cases succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform abuse cases
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.abuse.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform abuse cases
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/abuse-cases/{commentId}:
+    get:
+      description: |
+        Operators only, with recent authentication. Reads one cross-platform
+        moderation case by stable comment id, including the comment body,
+        content and parent coordinates, and sorted distinct reasons from open
+        reports. Reporter identities and report notes are never exposed.
+      operationId: getPlatformAbuseCasesByCommentId
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: 018f0000-0000-7000-8000-000000000001
+          in: path
+          name: commentId
+          required: true
+          schema:
+            format: uuid
+            pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    body: Great article.
+                    commentId: 018f0000-0000-7000-8000-000000000003
+                    commentState: VISIBLE_PENDING_SCAN
+                    contentId: 018f0000-0000-7000-8000-000000000004
+                    firstReportedAt: "2026-10-10T10:30:00.000Z"
+                    lastReportedAt: "2026-10-10T11:00:00.000Z"
+                    openReportCount: 1
+                    organizationId: 018f0000-0000-7000-8000-000000000001
+                    parentId: null
+                    publicationId: 018f0000-0000-7000-8000-000000000002
+                    reportReasons:
+                      - OTHER
+                    totalReportCount: 1
+                    updatedAt: "2026-10-10T11:00:00.000Z"
+              schema:
+                $ref: "#/components/schemas/GetPlatformAbuseCasesByCommentIdResponse"
+          description: read platform abuse case succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+      security:
+        - browserSession: []
+      summary: read platform abuse case
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.abuse.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: read platform abuse case
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - RESOURCE_NOT_FOUND
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/abuse-cases/{commentId}:decide:
+    post:
+      description: |
+        Operators only, with recent authentication. Applies one existing
+        `ModerationDecision` after rechecking the comment and appeal state.
+        Inapplicable decisions return `INVALID_DECISION`. `reason` is the
+        non-sensitive operator reason code recorded in the audit event.
+      operationId: postPlatformAbuseCasesByCommentIdDecide
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: 018f0000-0000-7000-8000-000000000001
+          in: path
+          name: commentId
+          required: true
+          schema:
+            format: uuid
+            pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+            type: string
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  decision: HOLD
+                  note: Pending a second review.
+                  reason: REPORTED_CONTENT_REVIEW
+            schema:
+              $ref: "#/components/schemas/PostPlatformAbuseCasesByCommentIdDecideRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    body: Great article.
+                    commentId: 018f0000-0000-7000-8000-000000000003
+                    commentState: HELD_REVIEW
+                    contentId: 018f0000-0000-7000-8000-000000000004
+                    firstReportedAt: "2026-10-10T10:30:00.000Z"
+                    lastReportedAt: "2026-10-10T11:00:00.000Z"
+                    openReportCount: 1
+                    organizationId: 018f0000-0000-7000-8000-000000000001
+                    parentId: null
+                    publicationId: 018f0000-0000-7000-8000-000000000002
+                    reportReasons:
+                      - OTHER
+                    totalReportCount: 1
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+              schema:
+                $ref: "#/components/schemas/PostPlatformAbuseCasesByCommentIdDecideResponse"
+          description: decide platform abuse case succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+        "409":
+          $ref: "#/components/responses/InvalidDecisionCommandConflict"
+      security:
+        - browserSession: []
+      summary: decide platform abuse case
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.abuse.remediate
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: decide platform abuse case
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - INVALID_DECISION
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - RESOURCE_NOT_FOUND
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: protocol
+      x-gala-tenant-scope: NONE
   /v2/platform/adapters:
     get:
       description: |
@@ -45843,7 +47386,8 @@ paths:
         Operators only (a configured platform operator with recent
         authentication). Audit events across every organization, newest first,
         filtered by any combination of organization, publication, actor, action
-        and time window (`from` inclusive, `to` exclusive).
+        and time window (`from` inclusive, `to` exclusive). The operator App
+        supplies the trailing seven days when the URL has no explicit range.
       operationId: getPlatformAuditEvents
       parameters:
         - $ref: "#/components/parameters/XCorrelationId"
@@ -46050,6 +47594,167 @@ paths:
         - NONE
       x-gala-success-category: query
       x-gala-tenant-scope: NONE
+  /v2/platform/caches:
+    get:
+      description: |
+        Operators only, with recent authentication. Lists the bounded cache
+        inventory, each durable all-instance eviction epoch, this serving
+        instance's entry count, and update version. Cache keys and values are
+        never exposed.
+      operationId: getPlatformCaches
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    items:
+                      - epoch: 3
+                        localEntryCount: 7
+                        name: GITHUB_INSTALLATION_TOKEN
+                        ttlSeconds: 300
+                        updatedAt: "2026-10-10T12:00:00.000Z"
+                        updatedByPersonId: 018f0000-0000-7000-8000-000000000001
+                        version: 3
+              schema:
+                $ref: "#/components/schemas/GetPlatformCachesResponse"
+          description: list platform caches succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform caches
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.caches.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform caches
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/caches/{cacheId}:evict:
+    post:
+      description: |
+        Operators only, with recent authentication. Advances the named cache's
+        durable epoch at the exact version in `If-Match`; all serving instances
+        converge on that epoch, while `localEntryCount` reports only the
+        responding instance. `reason` is the non-sensitive reason code recorded
+        in the audit event.
+      operationId: postPlatformCachesByCacheIdEvict
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: GITHUB_INSTALLATION_TOKEN
+          in: path
+          name: cacheId
+          required: true
+          schema:
+            enum:
+              - GITHUB_INSTALLATION_TOKEN
+              - GITHUB_REPOSITORY_METADATA
+              - GITHUB_REPOSITORY_CONTENT
+            type: string
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/IfMatch"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  reason: CREDENTIAL_ROTATION
+            schema:
+              $ref: "#/components/schemas/PostPlatformCachesByCacheIdEvictRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    epoch: 4
+                    localEntryCount: 0
+                    name: GITHUB_INSTALLATION_TOKEN
+                    ttlSeconds: 300
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+                    updatedByPersonId: 018f0000-0000-7000-8000-000000000001
+                    version: 4
+              schema:
+                $ref: "#/components/schemas/PostPlatformCachesByCacheIdEvictResponse"
+          description: evict platform cache succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            ETag:
+              $ref: "#/components/headers/ETag"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+        "409":
+          $ref: "#/components/responses/CommandReplayConflict"
+        "412":
+          $ref: "#/components/responses/StaleAggregateVersion"
+      security:
+        - browserSession: []
+      summary: evict platform cache
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.caches.manage
+      x-gala-concurrency: if-match-platform-cache-version
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: evict platform cache
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - RESOURCE_NOT_FOUND
+        - STALE_AGGREGATE_VERSION
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: update
+      x-gala-tenant-scope: NONE
   /v2/platform/configuration:
     get:
       description: |
@@ -46176,6 +47881,836 @@ paths:
         - NONE
       x-gala-success-category: query
       x-gala-tenant-scope: NONE
+  /v2/platform/oauth-clients:
+    get:
+      description: |
+        Operators only, with recent authentication. Lists OAuth client registry
+        metadata. Client secrets are never returned by this or any later read.
+      operationId: getPlatformOauthClients
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    items:
+                      - accessTokenTtlSeconds: 3600
+                        clientId: gala_0123456789abcdefghijklmnopqrstuv
+                        clientType: CONFIDENTIAL
+                        createdAt: "2026-10-10T12:00:00.000Z"
+                        createdByPersonId: 018f0000-0000-7000-8000-000000000002
+                        description: Connect automation and monitoring tools.
+                        grantTypes:
+                          - AUTHORIZATION_CODE
+                          - REFRESH_TOKEN
+                          - CLIENT_CREDENTIALS
+                        homepageUri: https://example.com/
+                        id: 018f0000-0000-7000-8000-000000000001
+                        logoUri: https://example.com/logo.png
+                        name: Automation client
+                        redirectUris:
+                          - https://example.com/oauth/callback
+                        revokedAt: null
+                        scopes:
+                          - read
+                          - write
+                        state: DRAFT
+                        updatedAt: "2026-10-10T12:00:00.000Z"
+                        version: 0
+              schema:
+                $ref: "#/components/schemas/GetPlatformOauthClientsResponse"
+          description: list OAuth clients succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list OAuth clients
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.oauth.clients.manage
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list OAuth clients
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+    post:
+      description: |
+        Operators only, with recent authentication. Registers one DRAFT OAuth
+        client. `reason` is a non-sensitive operator reason code recorded in
+        the audit event. `Idempotency-Key` is the registry-row identity. The
+        generated CONFIDENTIAL-client secret is disclosed only by the first
+        successful response and is never stored in plaintext; PUBLIC clients
+        and committed retries return `clientSecret` null or omitted.
+      operationId: postPlatformOauthClients
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  accessTokenTtlSeconds: 3600
+                  clientType: CONFIDENTIAL
+                  description: Connect automation and monitoring tools.
+                  grantTypes:
+                    - AUTHORIZATION_CODE
+                    - REFRESH_TOKEN
+                    - CLIENT_CREDENTIALS
+                  homepageUri: https://example.com/
+                  logoUri: https://example.com/logo.png
+                  name: Automation client
+                  reason: OPERATOR_REQUESTED
+                  redirectUris:
+                    - https://example.com/oauth/callback
+                  scopes:
+                    - read
+                    - write
+            schema:
+              $ref: "#/components/schemas/PostPlatformOauthClientsRequest"
+        required: true
+      responses:
+        "201":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    client:
+                      accessTokenTtlSeconds: 3600
+                      clientId: gala_0123456789abcdefghijklmnopqrstuv
+                      clientType: CONFIDENTIAL
+                      createdAt: "2026-10-10T12:00:00.000Z"
+                      createdByPersonId: 018f0000-0000-7000-8000-000000000002
+                      description: Connect automation and monitoring tools.
+                      grantTypes:
+                        - AUTHORIZATION_CODE
+                        - REFRESH_TOKEN
+                        - CLIENT_CREDENTIALS
+                      homepageUri: https://example.com/
+                      id: 018f0000-0000-7000-8000-000000000001
+                      logoUri: https://example.com/logo.png
+                      name: Automation client
+                      redirectUris:
+                        - https://example.com/oauth/callback
+                      revokedAt: null
+                      scopes:
+                        - read
+                        - write
+                      state: DRAFT
+                      updatedAt: "2026-10-10T12:00:00.000Z"
+                      version: 0
+                    clientSecret: gala_secret_0123456789abcdefghijklmnopqrstuv
+              schema:
+                $ref: "#/components/schemas/PostPlatformOauthClientsResponse"
+          description: register OAuth client succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            Location:
+              $ref: "#/components/headers/Location"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "409":
+          $ref: "#/components/responses/CommandReplayConflict"
+      security:
+        - browserSession: []
+      summary: register OAuth client
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.oauth.clients.manage
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: register OAuth client
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: create
+      x-gala-tenant-scope: NONE
+  /v2/platform/oauth-clients/{oauthClientId}:revoke:
+    post:
+      description: |
+        Operators only, with recent authentication. Revokes exactly the DRAFT
+        registry entry named by `oauthClientId` (the entry's `id`, a UUID) at the
+        version in `If-Match`; the public OAuth `clientId` remains response
+        metadata. A REVOKED client is
+        rejected with `INVALID_SOURCE_STATE`. `reason` is the non-sensitive
+        reason code recorded in the audit event.
+      operationId: postPlatformOauthClientsByOauthClientIdRevoke
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: 018f0000-0000-7000-8000-000000000001
+          in: path
+          name: oauthClientId
+          required: true
+          schema:
+            format: uuid
+            pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+            type: string
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/IfMatch"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  reason: INTEGRATION_RETIRED
+            schema:
+              $ref: "#/components/schemas/PostPlatformOauthClientsByOauthClientIdRevokeRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    accessTokenTtlSeconds: 3600
+                    clientId: gala_0123456789abcdefghijklmnopqrstuv
+                    clientType: CONFIDENTIAL
+                    createdAt: "2026-10-10T12:00:00.000Z"
+                    createdByPersonId: 018f0000-0000-7000-8000-000000000002
+                    description: Connect automation and monitoring tools.
+                    grantTypes:
+                      - CLIENT_CREDENTIALS
+                    homepageUri: https://example.com/
+                    id: 018f0000-0000-7000-8000-000000000001
+                    logoUri: https://example.com/logo.png
+                    name: Automation client
+                    redirectUris: []
+                    revokedAt: "2026-10-10T13:00:00.000Z"
+                    scopes:
+                      - metrics:read
+                    state: REVOKED
+                    updatedAt: "2026-10-10T13:00:00.000Z"
+                    version: 1
+              schema:
+                $ref: "#/components/schemas/PostPlatformOauthClientsByOauthClientIdRevokeResponse"
+          description: revoke OAuth client succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            ETag:
+              $ref: "#/components/headers/ETag"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+        "409":
+          $ref: "#/components/responses/InvalidSourceStateCommandConflict"
+        "412":
+          $ref: "#/components/responses/StaleAggregateVersion"
+      security:
+        - browserSession: []
+      summary: revoke OAuth client
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.oauth.clients.manage
+      x-gala-concurrency: if-match-oauth-client-version
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: revoke OAuth client
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - INVALID_SOURCE_STATE
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - RESOURCE_NOT_FOUND
+        - STALE_AGGREGATE_VERSION
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - OAuthClient:DRAFT -> REVOKED
+      x-gala-success-category: update
+      x-gala-tenant-scope: NONE
+  /v2/platform/overview:
+    get:
+      description: |
+        Operators only, with recent authentication. A bounded platform summary
+        for the dashboard landing page. Counts use exact persisted person,
+        organization, publication, comment, reaction, OAuth client, abuse, and
+        webhook states. The webhook counters cover the trailing seven days;
+        no traffic or subscription fact is inferred.
+      operationId: getPlatformOverview
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    commentDeletedByAuthor: 1
+                    commentHeldReview: 2
+                    commentRemoved: 3
+                    commentVisible: 41
+                    commentVisibleFlagged: 4
+                    commentVisiblePendingScan: 2
+                    oauthClientDraft: 2
+                    oauthClientRevoked: 1
+                    openAbuseCases: 3
+                    organizationActive: 5
+                    organizationBusiness: 1
+                    organizationClosed: 0
+                    organizationClosing: 0
+                    organizationFree: 2
+                    organizationPro: 2
+                    organizationProvisioning: 1
+                    organizationSuspended: 0
+                    personActive: 8
+                    personClosed: 1
+                    personClosing: 0
+                    personRestricted: 1
+                    personSuspended: 1
+                    publicationActive: 12
+                    publicationPaused: 1
+                    publicationProvisioning: 1
+                    publicationRetired: 2
+                    publicationRetiring: 1
+                    reactionActive: 63
+                    reactionInactive: 4
+                    webhookProcessed7d: 25
+                    webhookProcessing7d: 1
+                    webhookQuarantined7d: 1
+                    webhookReceived7d: 2
+              schema:
+                $ref: "#/components/schemas/GetPlatformOverviewResponse"
+          description: read the platform dashboard overview succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: read the platform dashboard overview
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.users.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: read the platform dashboard overview
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/plans:
+    get:
+      description: |
+        Operators only, with recent authentication. Returns the complete,
+        active publication-capacity release with its single optimistic-lock
+        version and the closed FREE, PRO, and BUSINESS plan catalog.
+      operationId: getPlatformPlans
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    effectiveAt: "2026-10-10T00:00:04.000Z"
+                    items:
+                      - planKey: FREE
+                        publicationLimit: 1
+                      - planKey: PRO
+                        publicationLimit: 10
+                      - planKey: BUSINESS
+                        publicationLimit: 50
+                    releaseId: 019d0000-2000-7000-8000-000000000001
+                    releaseVersion: 2
+                    state: ACTIVE
+                    updatedAt: "2026-10-10T00:00:04.000Z"
+              schema:
+                $ref: "#/components/schemas/GetPlatformPlansResponse"
+          description: list platform plans succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform plans
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.plans.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform plans
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/plans/{planKey}:
+    put:
+      description: |
+        Operators only, with recent authentication. Atomically replaces the
+        complete publication-capacity release, changing the named plan's limit
+        while retaining the other two, at the release version in `If-Match`.
+        The invariant FREE <= PRO <= BUSINESS is enforced. `reason` is a
+        non-sensitive operator reason code recorded in the audit event.
+      operationId: putPlatformPlansByPlanKey
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: PRO
+          in: path
+          name: planKey
+          required: true
+          schema:
+            $ref: "#/components/schemas/PlatformPlanKey"
+        - $ref: "#/components/parameters/IdempotencyKey"
+        - $ref: "#/components/parameters/IfMatch"
+        - $ref: "#/components/parameters/XCsrfToken"
+      requestBody:
+        content:
+          application/json:
+            examples:
+              nominal:
+                summary: Nominal valid request
+                value:
+                  publicationLimit: 12
+                  reason: PLAN_LIMIT_UPDATE
+            schema:
+              $ref: "#/components/schemas/PutPlatformPlansByPlanKeyRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    effectiveAt: "2026-10-10T12:00:00.000Z"
+                    items:
+                      - planKey: FREE
+                        publicationLimit: 1
+                      - planKey: PRO
+                        publicationLimit: 12
+                      - planKey: BUSINESS
+                        publicationLimit: 50
+                    releaseId: 019d0000-2000-7000-8000-000000000002
+                    releaseVersion: 3
+                    state: ACTIVE
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+              schema:
+                $ref: "#/components/schemas/PutPlatformPlansByPlanKeyResponse"
+          description: update platform plan succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            ETag:
+              $ref: "#/components/headers/ETag"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/RequestInvalid"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+        "409":
+          $ref: "#/components/responses/CommandReplayConflict"
+        "412":
+          $ref: "#/components/responses/StaleAggregateVersion"
+      security:
+        - browserSession: []
+      summary: update platform plan
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.plans.manage
+      x-gala-concurrency: if-match-platform-plan-release-version
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: update platform plan
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - COMMAND_REPLAY_CONFLICT
+        - REAUTH_REQUIRED
+        - REQUEST_FIELD_UNKNOWN
+        - RESOURCE_NOT_FOUND
+        - STALE_AGGREGATE_VERSION
+        - VALIDATION_FAILED
+      x-gala-replay-identity: idempotency-key
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: update
+      x-gala-tenant-scope: NONE
+  /v2/platform/users:
+    get:
+      description: |
+        Operators only, with recent authentication. Keyset-paged principals
+        across the platform with exact person state, provider display snapshots,
+        creation and last-sign-in instants, accessible publication count, and
+        the distinct organization plan tiers reached through current grants.
+        Subscription and per-user traffic data are not inferred.
+      operationId: getPlatformUsers
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - description: Only people in this exact persisted state.
+          example: ACTIVE
+          in: query
+          name: state
+          required: false
+          schema:
+            $ref: "#/components/schemas/PlatformPersonState"
+        - description: Case-insensitive match against person id, display name, or login.
+          example: ada
+          in: query
+          name: search
+          required: false
+          schema:
+            maxLength: 200
+            minLength: 1
+            type: string
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    hasMore: false
+                    items:
+                      - createdAt: "2026-09-01T12:00:00.000Z"
+                        displayName: Ada Reader
+                        lastSignInAt: "2026-10-10T11:30:00.000Z"
+                        login: ada-reader
+                        personId: 018f0000-0000-7000-8000-000000000001
+                        planTiers:
+                          - FREE
+                          - PRO
+                        publicationCount: 2
+                        state: ACTIVE
+                    nextCursor: null
+              schema:
+                $ref: "#/components/schemas/GetPlatformUsersResponse"
+          description: list platform users succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform users
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.users.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform users
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/webhook-events:
+    get:
+      description: |
+        Operators only, with recent authentication. Returns redacted GitHub
+        webhook inbox metadata, newest first. Bodies and payload digests are
+        never exposed. `from` is inclusive and `to` is exclusive; the operator
+        App supplies the trailing seven days when the URL has no explicit
+        range.
+      operationId: getPlatformWebhookEvents
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - description: Only events with this GitHub event type.
+          example: PUSH
+          in: query
+          name: eventType
+          required: false
+          schema:
+            $ref: "#/components/schemas/PlatformWebhookEventType"
+        - description: Only events in this processing state.
+          example: PROCESSED
+          in: query
+          name: status
+          required: false
+          schema:
+            $ref: "#/components/schemas/PlatformWebhookProcessingStatus"
+        - description: Only events first seen at or after this instant.
+          example: "2026-10-03T12:00:00.000Z"
+          in: query
+          name: from
+          required: false
+          schema:
+            description: "Canonical Gala instant: the UTC millisecond subset of RFC 3339, exactly `YYYY-MM-DDThh:mm:ss.sssZ`. Stated here rather than as a `pattern` because a generated `OffsetDateTime` cannot carry one (LOCAL-56)."
+            format: date-time
+            type: string
+        - description: Only events first seen before this instant.
+          example: "2026-10-10T12:00:00.000Z"
+          in: query
+          name: to
+          required: false
+          schema:
+            description: "Canonical Gala instant: the UTC millisecond subset of RFC 3339, exactly `YYYY-MM-DDThh:mm:ss.sssZ`. Stated here rather than as a `pattern` because a generated `OffsetDateTime` cannot carry one (LOCAL-56)."
+            format: date-time
+            type: string
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    hasMore: false
+                    items:
+                      - attemptCount: 1
+                        attemptLimit: 12
+                        eventId: 018f0000-0000-7000-8000-000000000001
+                        eventType: PUSH
+                        firstSeenAt: "2026-10-10T11:59:58.000Z"
+                        organizationId: 018f0000-0000-7000-8000-000000000003
+                        processedAt: "2026-10-10T12:00:00.000Z"
+                        providerRepositoryId: 123456789
+                        pullRequestNumber: null
+                        resultCode: APPLIED
+                        status: PROCESSED
+                        updatedAt: "2026-10-10T12:00:00.000Z"
+                        workflowRunId: null
+                    nextCursor: null
+              schema:
+                $ref: "#/components/schemas/GetPlatformWebhookEventsResponse"
+          description: list platform webhook events succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+      security:
+        - browserSession: []
+      summary: list platform webhook events
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.webhooks.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: list platform webhook events
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
+  /v2/platform/webhook-events/{eventId}:
+    get:
+      description: |
+        Operators only, with recent authentication. Reads one redacted webhook
+        inbox event by stable id. The request body and payload digest are never
+        exposed.
+      operationId: getPlatformWebhookEventsByEventId
+      parameters:
+        - $ref: "#/components/parameters/XCorrelationId"
+        - example: 018f0000-0000-7000-8000-000000000001
+          in: path
+          name: eventId
+          required: true
+          schema:
+            format: uuid
+            pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
+            type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              examples:
+                nominal:
+                  summary: Nominal successful response
+                  value:
+                    attemptCount: 1
+                    attemptLimit: 12
+                    eventId: 018f0000-0000-7000-8000-000000000001
+                    eventType: PUSH
+                    firstSeenAt: "2026-10-10T11:59:58.000Z"
+                    organizationId: 018f0000-0000-7000-8000-000000000003
+                    processedAt: "2026-10-10T12:00:00.000Z"
+                    providerRepositoryId: 123456789
+                    pullRequestNumber: null
+                    resultCode: APPLIED
+                    status: PROCESSED
+                    updatedAt: "2026-10-10T12:00:00.000Z"
+                    workflowRunId: null
+              schema:
+                $ref: "#/components/schemas/GetPlatformWebhookEventsByEventIdResponse"
+          description: read platform webhook event succeeded
+          headers:
+            Cache-Control:
+              $ref: "#/components/headers/CacheControlNoStore"
+            X-Correlation-Id:
+              $ref: "#/components/headers/XCorrelationId"
+        "400":
+          $ref: "#/components/responses/ValidationFailed"
+        "401":
+          $ref: "#/components/responses/PlatformAuthenticationRequired"
+        "403":
+          $ref: "#/components/responses/AuthorizationDenied"
+        "404":
+          $ref: "#/components/responses/ResourceNotFound"
+      security:
+        - browserSession: []
+      summary: read platform webhook event
+      tags:
+        - platform
+      x-gala-activation-gate: MVP
+      x-gala-activation-guards:
+        - NONE
+      x-gala-capability-key: platform.webhooks.view
+      x-gala-concurrency: none
+      x-gala-conditional-capabilities: []
+      x-gala-example-profile: NOMINAL_SUCCESS_AND_EACH_REACHABLE_PROBLEM
+      x-gala-nullability: required-and-nullable-are-explicit
+      x-gala-purpose: read platform webhook event
+      x-gala-reachable-problems:
+        - AUTHENTICATION_REQUIRED
+        - AUTHORIZATION_DENIED
+        - REAUTH_REQUIRED
+        - RESOURCE_NOT_FOUND
+        - VALIDATION_FAILED
+      x-gala-replay-identity: safe-query
+      x-gala-state-guards:
+        - NONE
+      x-gala-success-category: query
+      x-gala-tenant-scope: NONE
   /v2/public/comments/{commentId}:
     delete:
       description: A comment that has replies stays as a tombstone.