@yemi33/minions 0.1.2424 → 0.1.2426

package/engine/api-contracts/agent-content.js

@@ -0,0 +1,761 @@
+'use strict';
+
+const agentApiValidation = require('../agent-api-validation');
+const steeringConstraints = require('../steering-constraints');
+const steeringStore = require('../steering-store');
+const { LIMITS, PIN_LEVELS } = require('../content-api-validation');
+
+function rejectsInvalid(...fields) {
+  return [{
+    strategy: 'reject-invalid-input-before-side-effects',
+    expectedStatus: '4xx',
+    fields,
+  }];
+}
+
+const AGENT_VALUES_SOURCE = 'config.agents keys + active temp dispatch agents';
+// Read-only output/detail routes additionally accept historical agents whose
+// dispatch has completed (or whose agents/<id>/ artifacts still persist), so
+// their path identifier advertises a broader source than the mutating routes.
+const READABLE_AGENT_VALUES_SOURCE = 'config.agents keys + active/completed dispatch agents + persisted agent output directories';
+
+function agentIdentifierField(name, valuesSource = AGENT_VALUES_SOURCE) {
+  return {
+    name,
+    type: 'identifier',
+    required: true,
+    maxLength: agentApiValidation.AGENT_ID_MAX_LENGTH,
+    allowedValuesSource: valuesSource,
+  };
+}
+
+function agentPath(name = 'id') {
+  return {
+    policy: 'required',
+    fields: [agentIdentifierField(name)],
+  };
+}
+
+// Path declaration for read-only output/detail routes (validateReadableAgent).
+function readableAgentPath(name = 'id') {
+  return {
+    policy: 'required',
+    fields: [agentIdentifierField(name, READABLE_AGENT_VALUES_SOURCE)],
+  };
+}
+
+function liveOutputOverride() {
+  return {
+    audit: 'audited',
+    path: readableAgentPath(),
+    query: {
+      policy: 'optional',
+      fields: [
+        {
+          name: 'tail',
+          type: 'integer',
+          required: false,
+          default: 8192,
+          min: 1,
+          max: agentApiValidation.LIVE_TAIL_MAX_BYTES,
+        },
+        { name: 'from', type: 'integer', required: false, min: 0 },
+        { name: 'to', type: 'integer', required: false, min: 1 },
+        { name: 'prev', type: 'boolean-string', required: false, allowedValues: ['0', '1'] },
+      ],
+    },
+    constraints: [
+      {
+        kind: 'mutually-exclusive-query-modes',
+        modes: [['tail'], ['from', 'to', 'prev']],
+      },
+      {
+        kind: 'paired-fields',
+        fields: ['from', 'to'],
+      },
+      {
+        kind: 'max-range-width',
+        fields: ['from', 'to'],
+        max: agentApiValidation.LIVE_RANGE_MAX_BYTES,
+      },
+    ],
+    negativeTests: [{
+      strategy: 'reject-before-output-open',
+      expectedStatus: '4xx',
+      audit: 'audited',
+    }],
+  };
+}
+
+const SIDE_EFFECT_NEGATIVE_TEST = {
+  strategy: 'in-process-http-reject-before-side-effects',
+  expectedStatus: '4xx',
+  audit: 'audited',
+};
+
+module.exports = {
+  owner: 'agent-content',
+  routes: [
+    'GET /api/agents',
+    'GET /api/pinned',
+    'POST /api/pinned',
+    'POST /api/pinned/remove',
+    'POST /api/pinned/update',
+    'GET /api/kb-pins',
+    'POST /api/kb-pins',
+    'POST /api/kb-pins/toggle',
+    'POST /api/notes',
+    'GET /api/notes-full',
+    'POST /api/notes-save',
+    'POST /api/agents/charter',
+    'POST /api/agents/steer',
+    'GET /api/agents/<agentId>/steering',
+    'GET /api/steering/<id>',
+    'POST /api/agents/cancel',
+    'POST /api/agent/<id>/kill',
+    'GET /api/agent/<id>/live-stream',
+    'GET /api/agent/<id>/live',
+    'GET /api/agent/<id>/live-output',
+    'GET /api/agent/<id>/output',
+    'GET /api/agent/<id>',
+    'GET /api/agent-output',
+    'GET /assets/memory-search.js',
+    'GET /api/knowledge',
+    'GET /api/memory-records/search',
+    'GET /api/memory-records/retrieval-decision',
+    'GET /api/memory-records/lifecycle',
+    'GET /api/memory-records/rollout',
+    'GET /api/memory-records/rollout-comparison',
+    'POST /api/memory-records/<id>/action',
+    'POST /api/memory-records/<id>/promote',
+    'POST /api/knowledge',
+    'POST /api/knowledge/sweep',
+    'GET /api/knowledge/sweep/status',
+    'GET /api/knowledge/<category>/<file>',
+    'POST /api/inbox/persist',
+    'POST /api/inbox/promote-kb',
+    'POST /api/inbox/open',
+    'POST /api/inbox/delete',
+    'GET /api/skill',
+    'GET /api/harness/diagnostics',
+  ],
+  bodyless: [
+    'POST /api/agent/<id>/kill',
+  ],
+  overrides: {
+    'GET /api/pinned': { noInput: true },
+    'GET /api/kb-pins': { noInput: true },
+    'GET /api/notes-full': { noInput: true },
+    'GET /api/knowledge': { noInput: true },
+    'GET /api/knowledge/sweep/status': { noInput: true },
+    'POST /api/pinned': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          { name: 'title', type: 'string', required: true, minLength: 1, maxLength: LIMITS.title },
+          { name: 'content', type: 'string', required: true, minLength: 1, maxLength: LIMITS.content },
+          {
+            name: 'level',
+            type: 'string',
+            required: false,
+            default: 'info',
+            allowedValues: PIN_LEVELS,
+          },
+        ],
+      },
+      negativeTests: rejectsInvalid('body', 'title', 'content', 'level'),
+    },
+    'POST /api/pinned/remove': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          { name: 'title', type: 'string', required: true, minLength: 1, maxLength: LIMITS.title },
+        ],
+      },
+      negativeTests: rejectsInvalid('body', 'title'),
+    },
+    'POST /api/pinned/update': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          { name: 'originalTitle', type: 'string', required: true, minLength: 1, maxLength: LIMITS.title },
+          { name: 'title', type: 'string', required: true, minLength: 1, maxLength: LIMITS.title },
+          { name: 'content', type: 'string', required: true, minLength: 1, maxLength: LIMITS.content },
+          {
+            name: 'level',
+            type: 'string',
+            required: false,
+            default: 'info',
+            allowedValues: PIN_LEVELS,
+          },
+        ],
+      },
+      negativeTests: rejectsInvalid('body', 'originalTitle', 'title', 'content', 'level'),
+    },
+    'POST /api/kb-pins': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [{
+          name: 'pins',
+          type: 'array<string>',
+          required: true,
+          maxLength: LIMITS.pinCount,
+          itemMaxLength: LIMITS.pinKey,
+        }],
+      },
+      negativeTests: rejectsInvalid('body', 'pins', 'pins[]'),
+    },
+    'POST /api/kb-pins/toggle': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          { name: 'key', type: 'string', required: true, minLength: 1, maxLength: LIMITS.pinKey },
+        ],
+      },
+      negativeTests: rejectsInvalid('body', 'key'),
+    },
+    'POST /api/notes': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          { name: 'title', type: 'string', required: true, minLength: 1, maxLength: LIMITS.title },
+          { name: 'what', type: 'string', required: false, maxLength: LIMITS.content },
+          { name: 'why', type: 'string', required: false, maxLength: LIMITS.reason },
+          { name: 'author', type: 'string', required: false, maxLength: LIMITS.author },
+        ],
+      },
+      aliases: [
+        { name: 'content', canonical: 'what', location: 'body' },
+        { name: 'description', canonical: 'what', location: 'body' },
+      ],
+      constraints: [{
+        rule: 'what takes precedence over content, then description; unknown fields remain allowed',
+      }],
+      negativeTests: rejectsInvalid('body', 'title', 'what', 'content', 'description', 'why', 'author'),
+    },
+    'POST /api/notes-save': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          { name: 'content', type: 'string', required: true, maxLength: LIMITS.content },
+          { name: 'file', type: 'string', required: false, default: 'notes.md', allowedValues: ['notes.md'] },
+        ],
+      },
+      negativeTests: rejectsInvalid('body', 'content', 'file'),
+    },
+    'POST /api/memory-records/<id>/action': {
+      audit: 'audited',
+      path: {
+        policy: 'required',
+        fields: [
+          { name: 'id', type: 'identifier', required: true, minLength: 1, maxLength: 128 },
+        ],
+      },
+      body: {
+        policy: 'required',
+        fields: [{
+          name: 'action',
+          type: 'string',
+          required: true,
+          allowedValuesSource: 'memory-store.ACTIONS',
+        }],
+      },
+      negativeTests: rejectsInvalid('body', 'id', 'action'),
+    },
+    'POST /api/knowledge': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          {
+            name: 'category',
+            type: 'string',
+            required: true,
+            allowedValuesSource: 'shared.KB_CATEGORIES',
+          },
+          { name: 'title', type: 'string', required: true, minLength: 1, maxLength: LIMITS.title },
+          { name: 'content', type: 'string', required: true, minLength: 1, maxLength: LIMITS.content },
+        ],
+      },
+      constraints: [{
+        rule: 'title must produce a non-empty safe slug; unknown fields remain allowed',
+      }],
+      negativeTests: rejectsInvalid('body', 'category', 'title', 'content'),
+    },
+    'GET /api/knowledge/<category>/<file>': {
+      audit: 'audited',
+      path: {
+        policy: 'required',
+        fields: [
+          {
+            name: 'category',
+            type: 'string',
+            required: true,
+            allowedValuesSource: 'shared.KB_READABLE_CATEGORIES',
+          },
+          {
+            name: 'file',
+            type: 'basename',
+            required: true,
+            maxLength: LIMITS.basename,
+            suffix: '.md',
+          },
+        ],
+      },
+    },
+    'POST /api/inbox/persist': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [{
+          name: 'name', type: 'basename', required: true, maxLength: LIMITS.basename, suffix: '.md',
+        }],
+      },
+      negativeTests: rejectsInvalid('body', 'name'),
+    },
+    'POST /api/inbox/promote-kb': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          { name: 'name', type: 'basename', required: true, maxLength: LIMITS.basename, suffix: '.md' },
+          {
+            name: 'category',
+            type: 'string',
+            required: true,
+            allowedValuesSource: 'shared.KB_CATEGORIES',
+          },
+        ],
+      },
+      negativeTests: rejectsInvalid('body', 'name', 'category'),
+    },
+    'POST /api/inbox/open': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [{
+          name: 'name', type: 'basename', required: true, maxLength: LIMITS.basename, suffix: '.md',
+        }],
+      },
+      negativeTests: rejectsInvalid('body', 'name'),
+    },
+    'POST /api/inbox/delete': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [{
+          name: 'name', type: 'basename', required: true, maxLength: LIMITS.basename, suffix: '.md',
+        }],
+      },
+      negativeTests: rejectsInvalid('body', 'name'),
+    },
+    'POST /api/agents/charter': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          agentIdentifierField('agent'),
+          {
+            name: 'content',
+            type: 'string',
+            required: true,
+            maxLength: agentApiValidation.AGENT_CHARTER_MAX_LENGTH,
+          },
+        ],
+      },
+      negativeTests: [SIDE_EFFECT_NEGATIVE_TEST],
+    },
+    'POST /api/agents/steer': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          agentIdentifierField('agent'),
+          {
+            name: 'message',
+            type: 'string',
+            required: true,
+            minLength: 1,
+            maxLength: agentApiValidation.STEERING_MESSAGE_MAX_LENGTH,
+          },
+          {
+            name: 'scope',
+            type: 'string',
+            required: false,
+            default: steeringConstraints.SCOPE.AGENT,
+            allowedValues: Object.values(steeringConstraints.SCOPE),
+          },
+          {
+            name: 'supersede',
+            type: 'string',
+            required: false,
+            allowedValuesSource: 'steeringConstraints.SUPERSEDE_MODE or steeringConstraints.isSteerId',
+          },
+        ],
+      },
+      constraints: [
+        {
+          kind: 'validate-before-supersede-or-write',
+          fields: ['agent', 'message', 'scope', 'supersede'],
+        },
+      ],
+      negativeTests: [SIDE_EFFECT_NEGATIVE_TEST],
+    },
+    'POST /api/knowledge/sweep': {
+      audit: 'audited',
+      body: {
+        policy: 'optional',
+        fields: [
+          {
+            name: 'pinnedKeys',
+            type: 'array<string>',
+            required: false,
+            maxLength: LIMITS.pinCount,
+            itemMaxLength: LIMITS.pinKey,
+            itemFormat: 'knowledge/<category>/<file>.md',
+          },
+          { name: 'dryRun', type: 'boolean', required: false },
+        ],
+      },
+      negativeTests: rejectsInvalid('body', 'pinnedKeys', 'pinnedKeys[]', 'dryRun'),
+    },
+    'GET /api/agents': {
+      audit: 'audited',
+      query: { policy: 'none', fields: [] },
+      noInputReason: 'The agent roster is derived from config, dispatch, and the agents directory; it consumes no caller-supplied body, path, query, or header input.',
+    },
+    'GET /api/agents/<agentId>/steering': {
+      audit: 'audited',
+      path: agentPath('agentId'),
+      query: {
+        policy: 'optional',
+        fields: [
+          {
+            name: 'limit',
+            type: 'integer',
+            required: false,
+            default: 50,
+            min: 1,
+            max: agentApiValidation.STEERING_LIST_MAX_LIMIT,
+          },
+          {
+            name: 'status',
+            type: 'string',
+            required: false,
+            allowedValues: [...steeringStore.VALID_STATUSES],
+            allowedValuesSource: 'steeringStore.VALID_STATUSES',
+          },
+        ],
+      },
+      negativeTests: [{
+        strategy: 'reject-before-steering-store-read',
+        expectedStatus: '4xx',
+        audit: 'audited',
+      }],
+    },
+    'GET /api/steering/<id>': {
+      audit: 'audited',
+      path: {
+        policy: 'required',
+        fields: [{
+          name: 'id',
+          type: 'identifier',
+          required: true,
+          pattern: 'steer-<10 hex characters>',
+          allowedValuesSource: 'steering.isSteerId',
+        }],
+      },
+      negativeTests: [{
+        strategy: 'reject-before-steering-store-read',
+        expectedStatus: '4xx',
+        audit: 'audited',
+      }],
+    },
+    'POST /api/agents/cancel': {
+      audit: 'audited',
+      body: {
+        policy: 'required',
+        fields: [
+          { ...agentIdentifierField('agent'), required: false },
+          { ...agentIdentifierField('agentId'), required: false },
+          {
+            name: 'task',
+            type: 'string',
+            required: false,
+            minLength: 1,
+            maxLength: agentApiValidation.CANCEL_TASK_MAX_LENGTH,
+          },
+          {
+            name: 'cancelTask',
+            type: 'string',
+            required: false,
+            minLength: 1,
+            maxLength: agentApiValidation.CANCEL_TASK_MAX_LENGTH,
+          },
+        ],
+      },
+      aliases: [
+        { name: 'agentId', canonical: 'agent' },
+        { name: 'cancelTask', canonical: 'task' },
+      ],
+      constraints: [
+        {
+          kind: 'exactly-one-target',
+          fields: ['agent', 'task'],
+          aliases: { agent: ['agentId'], task: ['cancelTask'] },
+        },
+        {
+          kind: 'selector-matches-exactly-one-active-dispatch',
+          fields: ['agent', 'task'],
+        },
+      ],
+      negativeTests: [SIDE_EFFECT_NEGATIVE_TEST],
+    },
+    'POST /api/agent/<id>/kill': {
+      audit: 'audited',
+      path: agentPath(),
+      negativeTests: [SIDE_EFFECT_NEGATIVE_TEST],
+    },
+    'GET /api/agent/<id>/live-stream': {
+      audit: 'audited',
+      path: readableAgentPath(),
+      query: {
+        policy: 'optional',
+        fields: [{
+          name: 'tail',
+          type: 'integer',
+          required: false,
+          default: agentApiValidation.LIVE_TAIL_MAX_BYTES,
+          min: 0,
+          max: agentApiValidation.LIVE_TAIL_MAX_BYTES,
+        }],
+      },
+      negativeTests: [{
+        strategy: 'reject-before-sse-headers-or-output-open',
+        expectedStatus: '4xx',
+        audit: 'audited',
+      }],
+    },
+    'GET /api/agent/<id>/live': liveOutputOverride(),
+    'GET /api/agent/<id>/live-output': liveOutputOverride(),
+    'GET /api/agent/<id>/output': {
+      audit: 'audited',
+      path: readableAgentPath(),
+      negativeTests: [{
+        strategy: 'reject-before-output-read',
+        expectedStatus: '4xx',
+        audit: 'audited',
+      }],
+    },
+    'GET /api/agent/<id>': {
+      audit: 'audited',
+      path: readableAgentPath(),
+      negativeTests: [{
+        strategy: 'reject-before-agent-file-reads',
+        expectedStatus: '4xx',
+        audit: 'audited',
+      }],
+    },
+    'GET /api/agent-output': {
+      audit: 'audited',
+      query: {
+        policy: 'required',
+        fields: [
+          {
+            name: 'file',
+            type: 'path',
+            required: true,
+            maxLength: agentApiValidation.OUTPUT_FILE_MAX_LENGTH,
+            allowedBasenames: agentApiValidation.OUTPUT_FILENAMES,
+            allowedValuesSource: 'agentApiValidation.OUTPUT_FILENAMES',
+          },
+        ],
+      },
+      constraints: [{
+        kind: 'contained-agent-output-path',
+        root: 'agents/<agent-id>',
+        filenames: agentApiValidation.OUTPUT_FILENAMES,
+      }],
+      negativeTests: [{
+        strategy: 'reject-traversal-or-unsupported-filename-before-open',
+        expectedStatus: '4xx',
+        audit: 'audited',
+      }],
+    },
+    'GET /api/memory-records/search': {
+      audit: 'audited',
+      query: {
+        policy: 'required',
+        fields: [
+          { name: 'q', type: 'string', required: true, minLength: 1, maxLength: LIMITS.memoryQuery },
+          {
+            name: 'status',
+            type: 'string',
+            required: false,
+            default: 'active',
+            allowedValuesSource: 'memory-store.STATUSES',
+          },
+          {
+            name: 'limit',
+            type: 'integer',
+            required: false,
+            default: 20,
+            min: 1,
+            max: LIMITS.memoryLimit,
+          },
+        ],
+      },
+    },
+    'GET /api/memory-records/retrieval-decision': {
+      // Read-only diagnostic: at least one of dispatchId/workItemId must be
+      // supplied; the handler 400s when both are absent. Values are bounded and
+      // redacted before use.
+      audit: 'audited',
+      query: {
+        policy: 'optional',
+        fields: [
+          { name: 'dispatchId', type: 'string', required: false, maxLength: 320 },
+          { name: 'workItemId', type: 'string', required: false, maxLength: 320 },
+          { name: 'project', type: 'string', required: false, allowedValuesSource: 'config.projects[].name' },
+          { name: 'retrievalKind', type: 'string', required: false },
+        ],
+      },
+      constraints: [
+        { kind: 'one-of', fields: ['dispatchId', 'workItemId'], minPresent: 1 },
+        { kind: 'bounded-redacted-query', fields: ['dispatchId', 'workItemId', 'project', 'retrievalKind'] },
+      ],
+      negativeTests: [
+        { strategy: 'omit-both-dispatch-and-work-item-id', expectedStatus: 400 },
+        { strategy: 'reject-oversized-or-malformed-identifier', expectedStatus: 400 },
+      ],
+    },
+    'GET /api/memory-records/lifecycle': {
+      audit: 'audited',
+      query: {
+        policy: 'optional',
+        fields: [
+          { name: 'project', type: 'string', required: false, allowedValuesSource: 'config.projects[].name' },
+          { name: 'eventType', type: 'string', required: false },
+          { name: 'findingKey', type: 'string', required: false },
+          { name: 'memoryId', type: 'string', required: false, maxLength: 320 },
+          { name: 'agent', type: 'string', required: false, allowedValuesSource: 'config.agents keys' },
+          { name: 'workItemId', type: 'string', required: false, maxLength: 320 },
+          { name: 'dispatchId', type: 'string', required: false, maxLength: 320 },
+          { name: 'limit', type: 'integer', required: false, default: 100, max: 200 },
+        ],
+      },
+      constraints: [
+        { kind: 'bounded-redacted-query', fields: ['project', 'eventType', 'findingKey', 'memoryId', 'agent', 'workItemId', 'dispatchId'] },
+        { kind: 'clamped-limit', field: 'limit', min: 1, max: 200, default: 100 },
+      ],
+      negativeTests: [
+        { strategy: 'reject-invalid-event-type-finding-or-agent-filter', expectedStatus: 400 },
+      ],
+    },
+    'GET /api/memory-records/rollout': {
+      audit: 'audited',
+      query: {
+        policy: 'optional',
+        fields: [
+          { name: 'project', type: 'string', required: false, allowedValuesSource: 'config.projects[].name' },
+          { name: 'area', type: 'string', required: false },
+          { name: 'from', type: 'number', required: false },
+          { name: 'to', type: 'number', required: false },
+          { name: 'minimumSample', type: 'number', required: false },
+        ],
+      },
+      constraints: [
+        { kind: 'numeric-window-fields', fields: ['from', 'to', 'minimumSample'] },
+      ],
+      negativeTests: [
+        { strategy: 'reject-non-numeric-window-field', expectedStatus: 400 },
+      ],
+    },
+    'GET /api/memory-records/rollout-comparison': {
+      // The handler treats every window/gate parameter as optional (empty values
+      // are skipped) and parses them with Number(), so `minReduction` is a numeric
+      // ratio rather than an integer.
+      audit: 'audited',
+      query: {
+        policy: 'optional',
+        fields: [
+          { name: 'baselineFrom', type: 'number', required: false },
+          { name: 'baselineTo', type: 'number', required: false },
+          { name: 'activeFrom', type: 'number', required: false },
+          { name: 'activeTo', type: 'number', required: false },
+          { name: 'project', type: 'string', required: false, allowedValuesSource: 'config.projects[].name' },
+          { name: 'area', type: 'string', required: false },
+          { name: 'minimumSample', type: 'number', required: false },
+          { name: 'minReduction', type: 'number', required: false },
+        ],
+      },
+      constraints: [
+        { kind: 'numeric-window-fields', fields: ['baselineFrom', 'baselineTo', 'activeFrom', 'activeTo', 'minimumSample', 'minReduction'] },
+      ],
+      negativeTests: [
+        { strategy: 'reject-non-numeric-window-field', expectedStatus: 400 },
+      ],
+    },
+    'POST /api/memory-records/<id>/promote': {
+      audit: 'audited',
+      path: {
+        policy: 'required',
+        fields: [
+          { name: 'id', type: 'identifier', required: true, minLength: 1, maxLength: 128 },
+        ],
+      },
+      body: {
+        policy: 'required',
+        fields: [
+          { name: 'targetKind', type: 'string', required: true, allowedValues: ['project-skill', 'repository-instruction'] },
+          { name: 'project', type: 'string', required: true, allowedValuesSource: 'config.projects[].name' },
+          { name: 'path', type: 'string', required: true },
+        ],
+      },
+      constraints: [
+        { kind: 'promotion-eligibility', description: 'The lesson must exist and satisfy verified-support promotion eligibility before a work item is queued.' },
+        { kind: 'never-edits-checkout', description: 'Promotion queues a project-bound work item; it never writes the operator checkout.' },
+      ],
+      negativeTests: [
+        { strategy: 'reject-missing-or-invalid-target-kind', expectedStatus: 400 },
+        { strategy: 'reject-unknown-project', expectedStatus: 400 },
+        { strategy: 'return-not-found-for-missing-lesson', expectedStatus: 404 },
+      ],
+    },
+    'GET /api/skill': {
+      audit: 'audited',
+      query: {
+        policy: 'required',
+        fields: [
+          { name: 'file', type: 'basename', required: true, maxLength: LIMITS.basename },
+          { name: 'source', type: 'string', required: false, maxLength: LIMITS.skillSource },
+          { name: 'dir', type: 'path', required: false, maxLength: LIMITS.skillDir },
+        ],
+      },
+      constraints: [{
+        rule: 'file must be a cross-platform safe basename; dir may be absolute but cannot contain traversal segments',
+      }],
+    },
+    'GET /assets/memory-search.js': {
+      audit: 'audited',
+      noInputReason: 'Serves one fixed bundled JavaScript asset from the dashboard source tree.',
+      constraints: [
+        {
+          kind: 'fixed-sandboxed-asset',
+          source: 'dashboard/js/memory-search.js',
+        },
+      ],
+    },
+    'GET /api/harness/diagnostics': {
+      audit: 'audited',
+      noInputReason: 'Inventories configured projects and canonical runtime adapters; accepts no caller input.',
+    },
+  },
+};