dominus-sdk-nodejs 11.0.2 → 11.0.5

package/docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md

@@ -1,102 +1,102 @@
-# Janitor Cleanup Audit: dominus-sdk-nodejs
-
-Generated: 2026-06-27 08:49 local
-Target repo: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
-Git root: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
-Branch/status: `production` — clean before this pass (no tracked or untracked changes).
-
-## Summary
-
-Wrote a source-backed agent-guide pack and wired it into `README.md` and
-`CLAUDE.md`. Corrected one proven-stale fact ("no committed automated tests")
-in three places. Auto-cleaned generated `dist/` (gitignored, reproducible).
-Everything left uncommitted per instructions. No tracked source, branches,
-worktrees, plans, or release artifacts deleted.
-
-## Executive Actions Applied
-
-| Action | Path | Why safe | Verification |
-|---|---|---|---|
-| Wrote agent-guide pack | `docs/agent-guide/**` | New docs only; no source touched. | Files present; INDEX/current point at snapshot. |
-| Wrote cleanup audit | `docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md` | New doc only. | This file. |
-| Wired guide into README | `README.md` | Added small "Agent Guide" section near top; no other content changed. | `git diff README.md` is the one added block. |
-| Wired guide into CLAUDE | `CLAUDE.md` | Added "Agent Guide Pack" pointer near top. | `git diff CLAUDE.md`. |
-| Fixed stale tests fact | `CLAUDE.md`, `docs/architecture.md` | `tests/` has 24 committed files run by `npm test`; old "no committed tests" claim was provably false. | `ls tests` (24 files); `package.json scripts.test` lists them. |
-| Auto-clean generated build | `dist/` | Gitignored, untracked, reproducible via `npm run build`; `prepublishOnly` rebuilds it. | `git check-ignore dist` = ignored; `git ls-files dist` empty; post-delete `git status` shows no tracked change. |
-
-## Docs Written
-
-| File | Purpose | Source-backed by |
-|---|---|---|
-| `docs/agent-guide/INDEX.md` | Stable entrypoint + snapshot history. | repo layout. |
-| `docs/agent-guide/current.md` | Latest snapshot pointer + top-5 refresh facts. | `package.json`, `src/index.ts`, `tests/`. |
-| `.../00-reading-order.md` | Read order + per-task source map + stale flags. | existing docs, `src/`. |
-| `.../01-purpose-and-boundaries.md` | Purpose, ownership, runtime class, boundary. | `package.json`, `CLAUDE.md`, workflows. |
-| `.../02-repo-map-and-entrypoints.md` | Directory map + entrypoints. | `find src`, `package.json`, `.github/workflows`. |
-| `.../03-api-surface.md` | 27 namespaces + auth/scope map. | `src/index.ts` wiring, `routes-services.md`. |
-| `.../04-data-state-and-storage.md` | Storage surfaces + in-process caches. | `docs/architecture.md` §2a, `src/lib/*`. |
-| `.../05-integrations-and-runtime.md` | Deps, gateway routing, env categories. | `package.json`, `CLAUDE.md`, `src/lib/config.ts`. |
-| `.../06-workflows-commands-and-ci.md` | Commands + CI lanes. | `package.json scripts`, `.github/workflows`. |
-| `.../07-operations-release-and-live-proof.md` | npm release lane + proof. | `publish-production.yml`, `package.json`, `workflow-hard-cut-release.md`. |
-| `.../08-security-privacy-and-secrets.md` | Auth boundaries, secret resolution. | `CLAUDE.md`, `src/lib/config.ts`, `.gitignore`. |
-| `.../09-known-risks-and-debt.md` | Stale docs, doc-drift, generated residue. | this audit, `docs/*`. |
-| `.../10-agent-playbook.md` | If-changing-X-read-Y + Kyle routing. | `CLAUDE.md`, `src/`. |
-
-## Drift Findings
-
-| Finding | Evidence | Risk | Recommendation | Approval needed |
-|---|---|---|---|---|
-| "No committed automated tests" claim stale | `tests/` has 24 files; `package.json scripts.test` runs them | Low (misleads agents) | Fixed in CLAUDE.md + architecture.md §10 | Done |
-| Hand-maintained counts may drift | `routes-services.md` says "450 commands / 29 surfaces"; actual `src/namespaces/` = 27 files | Low | Noted in 09 + architecture §10; re-derive from source before quoting | No |
-
-## Stale Or Conflicting Docs
-
-| Doc | Problem | Stronger source | Proposed action |
-|---|---|---|---|
-| `docs/architecture.md` §10 | claimed no committed tests | `tests/` + `package.json` | Fixed (replaced with count-drift note). |
-| `CLAUDE.md` Validation | "If tests are absent" framing | `tests/` (24 files) | Fixed to state tests are committed. |
-| `routes-services.md` counts | "29 namespace surfaces" vs 27 top-level files | `src/namespaces/` | Left as-is (counts include `ai.*` sub-namespaces + `auth` local helpers; not provably wrong). Flagged for re-derivation. |
-
-## Orphan / Generated / Scratch Candidates
-
-| Path | Evidence | Proposed action | Safe now? |
-|---|---|---|---|
-| `dist/` | gitignored build output (~1.6 MB) | Deleted | Yes (done) |
-| `node_modules/` | gitignored installed deps | Leave; not in the auto-apply allowlist; reproducible via `npm ci` but may be in use by a dev session | Not auto-deleted |
-
-## Auto-Cleanup Performed
-
-| Path | Evidence | Action | Verification |
-|---|---|---|---|
-| `dist/` | `git check-ignore dist` = ignored; `git ls-files dist` empty; reproducible via `npm run build` | `rm -rf dist` | Post-delete `git status` shows no tracked change; rebuild with `npm run build`. |
-
-## Expert Review Queue
-
-| Candidate | Why expert should view it first | Suggested expert | First review question |
-|---|---|---|---|
-| `routes-services.md` "450 commands / 29 surfaces" reconciliation | Authoritative re-count of public commands vs. the maintained matrix touches the platform client contract surface | dominus-expert | Are the documented counts accurate against current `src/namespaces/*.ts`, and should they be regenerated by a script instead of hand-maintained? |
-
-## Worktree / Branch / Plan Residue
-
-| Item | Evidence | Proposed action | Owner |
-|---|---|---|---|
-| None | Single repo dir; no `.git/worktrees` scratch, no stray plans found | None | — |
-
-## Approval Queue
-
-- [ ] Delete `node_modules/` (reproducible via `npm ci`) — only if no dev session is using it — validate with `npm ci && npm test`.
-
-## Not Touching
-
-- `dist/` rebuild — left for the developer to regenerate via `npm run build`.
-- `node_modules/` — installed deps; outside the granted auto-clean allowlist.
-- `docs/usage-reference.md` (~98 KB) — large reference, not rewritten; only flagged for count drift.
-- All tracked source, `CHANGELOG.md` history, CI workflows, branches.
-
-## Follow-Up Skills
-
-| Need | Skill | First action |
-|---|---|---|
-| Reconcile documented command counts | dominus-expert | Re-count public commands against `src/namespaces/`. |
-| If truth scatters across code/docs/CI | kyle-atlas | Build `docs/atlas/INDEX.md`. |
-| Durable cross-repo facts | kyle-learn | Promote to `.claude/knowledge` if reused. |
+# Janitor Cleanup Audit: dominus-sdk-nodejs
+
+Generated: 2026-06-27 08:49 local
+Target repo: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
+Git root: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
+Branch/status: `production` — clean before this pass (no tracked or untracked changes).
+
+## Summary
+
+Wrote a source-backed agent-guide pack and wired it into `README.md` and
+`CLAUDE.md`. Corrected one proven-stale fact ("no committed automated tests")
+in three places. Auto-cleaned generated `dist/` (gitignored, reproducible).
+Everything left uncommitted per instructions. No tracked source, branches,
+worktrees, plans, or release artifacts deleted.
+
+## Executive Actions Applied
+
+| Action | Path | Why safe | Verification |
+|---|---|---|---|
+| Wrote agent-guide pack | `docs/agent-guide/**` | New docs only; no source touched. | Files present; INDEX/current point at snapshot. |
+| Wrote cleanup audit | `docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md` | New doc only. | This file. |
+| Wired guide into README | `README.md` | Added small "Agent Guide" section near top; no other content changed. | `git diff README.md` is the one added block. |
+| Wired guide into CLAUDE | `CLAUDE.md` | Added "Agent Guide Pack" pointer near top. | `git diff CLAUDE.md`. |
+| Fixed stale tests fact | `CLAUDE.md`, `docs/architecture.md` | `tests/` has 24 committed files run by `npm test`; old "no committed tests" claim was provably false. | `ls tests` (24 files); `package.json scripts.test` lists them. |
+| Auto-clean generated build | `dist/` | Gitignored, untracked, reproducible via `npm run build`; `prepublishOnly` rebuilds it. | `git check-ignore dist` = ignored; `git ls-files dist` empty; post-delete `git status` shows no tracked change. |
+
+## Docs Written
+
+| File | Purpose | Source-backed by |
+|---|---|---|
+| `docs/agent-guide/INDEX.md` | Stable entrypoint + snapshot history. | repo layout. |
+| `docs/agent-guide/current.md` | Latest snapshot pointer + top-5 refresh facts. | `package.json`, `src/index.ts`, `tests/`. |
+| `.../00-reading-order.md` | Read order + per-task source map + stale flags. | existing docs, `src/`. |
+| `.../01-purpose-and-boundaries.md` | Purpose, ownership, runtime class, boundary. | `package.json`, `CLAUDE.md`, workflows. |
+| `.../02-repo-map-and-entrypoints.md` | Directory map + entrypoints. | `find src`, `package.json`, `.github/workflows`. |
+| `.../03-api-surface.md` | 27 namespaces + auth/scope map. | `src/index.ts` wiring, `routes-services.md`. |
+| `.../04-data-state-and-storage.md` | Storage surfaces + in-process caches. | `docs/architecture.md` §2a, `src/lib/*`. |
+| `.../05-integrations-and-runtime.md` | Deps, gateway routing, env categories. | `package.json`, `CLAUDE.md`, `src/lib/config.ts`. |
+| `.../06-workflows-commands-and-ci.md` | Commands + CI lanes. | `package.json scripts`, `.github/workflows`. |
+| `.../07-operations-release-and-live-proof.md` | npm release lane + proof. | `publish-production.yml`, `package.json`, `workflow-hard-cut-release.md`. |
+| `.../08-security-privacy-and-secrets.md` | Auth boundaries, secret resolution. | `CLAUDE.md`, `src/lib/config.ts`, `.gitignore`. |
+| `.../09-known-risks-and-debt.md` | Stale docs, doc-drift, generated residue. | this audit, `docs/*`. |
+| `.../10-agent-playbook.md` | If-changing-X-read-Y + Kyle routing. | `CLAUDE.md`, `src/`. |
+
+## Drift Findings
+
+| Finding | Evidence | Risk | Recommendation | Approval needed |
+|---|---|---|---|---|
+| "No committed automated tests" claim stale | `tests/` has 24 files; `package.json scripts.test` runs them | Low (misleads agents) | Fixed in CLAUDE.md + architecture.md §10 | Done |
+| Hand-maintained counts may drift | `routes-services.md` says "450 commands / 29 surfaces"; actual `src/namespaces/` = 27 files | Low | Noted in 09 + architecture §10; re-derive from source before quoting | No |
+
+## Stale Or Conflicting Docs
+
+| Doc | Problem | Stronger source | Proposed action |
+|---|---|---|---|
+| `docs/architecture.md` §10 | claimed no committed tests | `tests/` + `package.json` | Fixed (replaced with count-drift note). |
+| `CLAUDE.md` Validation | "If tests are absent" framing | `tests/` (24 files) | Fixed to state tests are committed. |
+| `routes-services.md` counts | "29 namespace surfaces" vs 27 top-level files | `src/namespaces/` | Left as-is (counts include `ai.*` sub-namespaces + `auth` local helpers; not provably wrong). Flagged for re-derivation. |
+
+## Orphan / Generated / Scratch Candidates
+
+| Path | Evidence | Proposed action | Safe now? |
+|---|---|---|---|
+| `dist/` | gitignored build output (~1.6 MB) | Deleted | Yes (done) |
+| `node_modules/` | gitignored installed deps | Leave; not in the auto-apply allowlist; reproducible via `npm ci` but may be in use by a dev session | Not auto-deleted |
+
+## Auto-Cleanup Performed
+
+| Path | Evidence | Action | Verification |
+|---|---|---|---|
+| `dist/` | `git check-ignore dist` = ignored; `git ls-files dist` empty; reproducible via `npm run build` | `rm -rf dist` | Post-delete `git status` shows no tracked change; rebuild with `npm run build`. |
+
+## Expert Review Queue
+
+| Candidate | Why expert should view it first | Suggested expert | First review question |
+|---|---|---|---|
+| `routes-services.md` "450 commands / 29 surfaces" reconciliation | Authoritative re-count of public commands vs. the maintained matrix touches the platform client contract surface | dominus-expert | Are the documented counts accurate against current `src/namespaces/*.ts`, and should they be regenerated by a script instead of hand-maintained? |
+
+## Worktree / Branch / Plan Residue
+
+| Item | Evidence | Proposed action | Owner |
+|---|---|---|---|
+| None | Single repo dir; no `.git/worktrees` scratch, no stray plans found | None | — |
+
+## Approval Queue
+
+- [ ] Delete `node_modules/` (reproducible via `npm ci`) — only if no dev session is using it — validate with `npm ci && npm test`.
+
+## Not Touching
+
+- `dist/` rebuild — left for the developer to regenerate via `npm run build`.
+- `node_modules/` — installed deps; outside the granted auto-clean allowlist.
+- `docs/usage-reference.md` (~98 KB) — large reference, not rewritten; only flagged for count drift.
+- All tracked source, `CHANGELOG.md` history, CI workflows, branches.
+
+## Follow-Up Skills
+
+| Need | Skill | First action |
+|---|---|---|
+| Reconcile documented command counts | dominus-expert | Re-count public commands against `src/namespaces/`. |
+| If truth scatters across code/docs/CI | kyle-atlas | Build `docs/atlas/INDEX.md`. |
+| Durable cross-repo facts | kyle-learn | Promote to `.claude/knowledge` if reused. |

package/docs/janitor/2026-08-04-sdk-nodejs-cleanup-audit.md

@@ -1,14 +1,14 @@
-# Janitor cleanup audit: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local.
-
-Refreshed the README and guide/atlas indexes, added a current reading-order
-pack, and mapped the root package surface, namespace ownership, lifecycle
-truth, secret/admin surfaces, and registry release path. Added a neutral
-pending-work summary for the preserved linked worktrees.
-
-No implementation branch or linked worktree was merged, rebased, deleted, or
-modified. Historical docs remain available. The Class D release metadata was
-bumped from 10.0.0 to 10.0.1 after verifying 10.0.1 was absent from the npm
-registry. After `npm ci` in the isolated snapshot, build, type tests, and the
-full 106-test runtime suite passed. `git diff --check` was run before commit.
+# Janitor cleanup audit: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local.
+
+Refreshed the README and guide/atlas indexes, added a current reading-order
+pack, and mapped the root package surface, namespace ownership, lifecycle
+truth, secret/admin surfaces, and registry release path. Added a neutral
+pending-work summary for the preserved linked worktrees.
+
+No implementation branch or linked worktree was merged, rebased, deleted, or
+modified. Historical docs remain available. The Class D release metadata was
+bumped from 10.0.0 to 10.0.1 after verifying 10.0.1 was absent from the npm
+registry. After `npm ci` in the isolated snapshot, build, type tests, and the
+full 106-test runtime suite passed. `git diff --check` was run before commit.

package/docs/migration-error-base.md

@@ -0,0 +1,115 @@
+# Node SDK Error Migration Guide: `DominusError` Subclasses
+
+**Version:** v1 (existing class names preserved) → planned v2 (deprecation warnings) → v3 (alias removal)
+
+**ADR:** [0010-sdk-exception-base-name.md](https://github.com/carebridgesystems/dominus-platform/blob/main/docs/adr/0010-sdk-exception-base-name.md) (Seams fork 6)
+
+This document is the S-4.8 / M-2 migration note. **No behavior change in v1.**
+
+---
+
+## (a) What changed
+
+The Node SDK already uses one canonical base, `DominusError`. Existing public
+exception class names remain subclasses of that base. `DominusError.toJSON()`
+emits the canonical envelope (`kind`, `code`, `request_id`, `http_status`,
+`envelope_version: "1"`, `recovery_action`).
+
+| Canonical Kind          | Existing class (v1)     | Default HTTP |
+|-------------------------|-------------------------|--------------|
+| `unauthorized`          | `AuthenticationError`   | 401          |
+| `forbidden`             | `AuthorizationError`    | 403          |
+| `not_found`             | `NotFoundError`         | 404          |
+| `validation_failed`     | `ValidationError`       | 400          |
+| `conflict`              | `ConflictError`         | 409          |
+| `upstream_unavailable`  | `ServiceError`          | 500          |
+| `timeout`               | `TimeoutError`          | —            |
+
+`ConnectionError` and `SecureTableError` also subclass `DominusError`.
+`raiseForStatus` still maps HTTP status codes to these same classes.
+
+---
+
+## (b) What stayed
+
+**Every existing public class name is preserved** in v1.
+`AuthenticationError` and the other historical names still subclass
+`DominusError`. Existing `instanceof` checks keep working.
+
+```ts
+import { AuthenticationError, DominusError } from 'dominus-sdk-nodejs';
+
+const err = new AuthenticationError('bad token');
+err instanceof AuthenticationError; // true
+err instanceof DominusError;        // true
+err.kind;                           // "unauthorized"
+```
+
+Existing catch sites do **not** need to change in v1.
+
+---
+
+## (c) How to migrate
+
+**Recommended v1 pattern** — catch `DominusError` and dispatch on `kind`:
+
+```ts
+import { DominusError } from 'dominus-sdk-nodejs';
+
+try {
+  await dominus.stash.put(/* ... */);
+} catch (err) {
+  if (err instanceof DominusError) {
+    if (err.kind === 'unauthorized') reauth();
+    else if (err.kind === 'rate_limited') backoff(err);
+    else throw err;
+  } else {
+    throw err;
+  }
+}
+```
+
+---
+
+## (d) v1 import pattern (now)
+
+```ts
+import {
+  DominusError,
+  AuthenticationError,
+  AuthorizationError,
+  NotFoundError,
+  ValidationError,
+  ConflictError,
+  ServiceError,
+  ConnectionError,
+  TimeoutError,
+  SecureTableError,
+  raiseForStatus,
+} from 'dominus-sdk-nodejs';
+```
+
+These names remain the public API in v1. They are the aliases that v2 will
+deprecate in favor of catching `DominusError` and branching on `kind`.
+
+---
+
+## (e) v2 deprecation timeline
+
+- **v1** (current): Existing exception class names remain `DominusError`
+  subclasses. **No warnings. No behavior change.**
+- **v2** (next major): The historical names (`AuthenticationError`,
+  `AuthorizationError`, `ValidationError`, `ServiceError`, `ConnectionError`,
+  `SecureTableError`) become deprecated aliases. They still construct and
+  catch the same errors.
+- **v3** (later): Those aliases are removed. Consumers catch `DominusError`
+  (or a per-`kind` subclass) and dispatch on `kind`.
+
+The deprecation window is governed by `dominus-cli/docs/deprecation-policy.md`.
+
+---
+
+## (f) Rollback
+
+Pin the SDK to the current major if you must stay on the historical class
+names only. v1 is fully backward-compatible; you can stay on it indefinitely.

package/docs/plans/2026-08-04-pending-work-fruition-summary.md

@@ -1,46 +1,46 @@
-# Pending work fruition summary: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local. This note analyzes existing linked work without
-changing it.
-
-## What is present
-
-The repository has four local linked worktrees around two related themes. The
-timeline contract v9 line adds a target query filter and retires the older
-company query option. The secret-presence-grid v10 lines add safe presence
-data, persisted root-role exposure, and preview code-point counting; reconciled
-and release branches carry the latest versions of that work. The main checkout
-was not modified and the current production snapshot is separate from those
-feature branches.
-
-## Likely path to completion
-
-1. Compare the timeline and secret-presence branches with current `production`
-   and choose one coherent SDK contract candidate. Preserve backward
-   compatibility only where the server contract still requires it.
-2. Trace the timeline query change through Authority methods, generated/public
-   types, tests, and README examples; confirm the retired company option is
-   absent where intended and target filtering is consistently shaped.
-3. Trace the secret-presence change through admin/secrets namespaces, preview
-   counting, root-role projections, public types, and server endpoints. Keep
-   all responses value-safe and avoid implying secret availability from
-   indeterminate provider state.
-4. Run build, type tests, the full Node test suite, and focused contract tests
-   on the reconciled candidate. Then bump the package version once for the
-   actual release candidate and verify the new version is absent from the
-   registry.
-5. Push the exact `production` candidate and use the publish workflow plus
-   registry/version verification to establish package completion. Pair that
-   with downstream Gateway/worker contract proof where the SDK behavior is
-   load-bearing.
-
-## Open questions
-
-- Whether timeline v9 and secret-presence v10 should ship together or as two
-  independently versioned SDK releases.
-- Whether persisted root-role data is already available in every targeted
-  server environment or needs a typed unavailable state in the SDK.
-- Which release branch is canonical among the reconciled and release worktrees.
-
-These questions are intentionally left for contract/release review; the
-existing implementation remains untouched.
+# Pending work fruition summary: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local. This note analyzes existing linked work without
+changing it.
+
+## What is present
+
+The repository has four local linked worktrees around two related themes. The
+timeline contract v9 line adds a target query filter and retires the older
+company query option. The secret-presence-grid v10 lines add safe presence
+data, persisted root-role exposure, and preview code-point counting; reconciled
+and release branches carry the latest versions of that work. The main checkout
+was not modified and the current production snapshot is separate from those
+feature branches.
+
+## Likely path to completion
+
+1. Compare the timeline and secret-presence branches with current `production`
+   and choose one coherent SDK contract candidate. Preserve backward
+   compatibility only where the server contract still requires it.
+2. Trace the timeline query change through Authority methods, generated/public
+   types, tests, and README examples; confirm the retired company option is
+   absent where intended and target filtering is consistently shaped.
+3. Trace the secret-presence change through admin/secrets namespaces, preview
+   counting, root-role projections, public types, and server endpoints. Keep
+   all responses value-safe and avoid implying secret availability from
+   indeterminate provider state.
+4. Run build, type tests, the full Node test suite, and focused contract tests
+   on the reconciled candidate. Then bump the package version once for the
+   actual release candidate and verify the new version is absent from the
+   registry.
+5. Push the exact `production` candidate and use the publish workflow plus
+   registry/version verification to establish package completion. Pair that
+   with downstream Gateway/worker contract proof where the SDK behavior is
+   load-bearing.
+
+## Open questions
+
+- Whether timeline v9 and secret-presence v10 should ship together or as two
+  independently versioned SDK releases.
+- Whether persisted root-role data is already available in every targeted
+  server environment or needs a typed unavailable state in the SDK.
+- Which release branch is canonical among the reconciled and release worktrees.
+
+These questions are intentionally left for contract/release review; the
+existing implementation remains untouched.

package/docs/routes-services.md

@@ -1,80 +1,80 @@
-# Routes, Services, and Endpoints Assessment
-
-This assessment is derived from all public namespace methods under `src/namespaces/` and their configured routes in SDK request calls.
-
-Audited commands: **~450** (hand-counted) across **27** top-level namespace files in `src/namespaces/`. The Service Matrix below lists **29** namespace surfaces because it expands dotted sub-namespaces (e.g. `ai.*` and `auth.*`) into their own rows, so the surface count is intentionally higher than the file count, not a typo. These totals are hand-maintained — re-derive from source before quoting.
-
-## Service Matrix
-
-| Service | Commands | Namespaces | Distinct Route Expressions | Notes |
-|---|---:|---|---:|---|
-| `guardian` | 146 | dominus.auth | 146 | HTTP API routes via Dominus client. |
-| `agent-runtime` | 53 | dominus.ai, dominus.ai.artifacts, dominus.ai.rag, dominus.ai.results, dominus.ai.tools, dominus.ai.workflow | 51 | HTTP API routes via Dominus client. |
-| `workflow-manager` | 38 | dominus.workflow | 36 | HTTP API routes via Dominus client. |
-| `authority` | 33 | dominus.authority | 33 | Hard-cut app/org/env Authority surface. |
-| `platform-worker` | 16 | dominus.platform | 16 | Gateway `/svc/platform/*` group/repository policy surface; policy helpers accept actor attribution headers. |
-| `coder-runtime` | 11 | dominus.coder | 11 | Gateway `/svc/coder/*` run lifecycle surface; launch requires exactly one workflow or pipeline recipe ref. |
-| `browser-worker` | 11 | dominus.browser | 10 | Authenticated `/svc/browser/*` browser automation primitive; Cloudflare Browser Run default, Browserbase fallback. |
-| `portal-worker` | 22 | dominus.portal | 22 | HTTP API routes via Dominus client. |
-| `db-worker` | 20 | dominus.db, dominus.ddl | 19 | HTTP API routes via Dominus client. |
-| `smith` | 15 | dominus.ddl | 15 | HTTP API routes via Dominus client. |
-| `b2-worker` | 14 | dominus.files | 14 | HTTP API routes via Dominus client. |
-| `redis-worker` | 14 | dominus.redis | 14 | HTTP API routes via Dominus client. |
-| `logs-worker` | 9 | dominus.logs | 4 | HTTP API routes via Dominus client; tail filters include `machine_id`. |
-| `scribe` | 7 | dominus.secure | 7 | HTTP API routes via Dominus client. |
-| `job-worker` | 8 | dominus.jobs | 6 | HTTP API routes via Dominus client. |
-| `artifact-worker` | 6 | dominus.artifacts | 6 | HTTP API routes via Dominus client. |
-| `stash-worker` managed tables | 6 | dominus.stash.tables | 6 | Typed self/group table routes through the authenticated gateway. |
-| `admin-worker` | 5 | dominus.admin, dominus.files | 5 | HTTP API routes via Dominus client. |
-| `warden` | 4 | dominus.secrets | 1 | Selected-scope grant semantics live in this group. |
-| `courier-worker` | 5 | dominus.courier | 2 | HTTP API routes via Dominus client. |
-| `gateway-local` | 4 | dominus.auth, dominus.health | 3 | Gateway `/health`, `/v1/ping`, and `/jwt/jwks` helpers. |
-| `processor-service` | 3 | dominus.processor | 3 | HTTP API routes via Dominus client. |
-| `sync-worker` | 2 | dominus.sync | 2 | HTTP API routes via Dominus client. |
-| `local-jwt` | 1 | dominus.auth | 1 | Local JWT parsing/validation helpers in auth namespace. |
-| `retired-stt` | 0 | (retired) | 0 | Legacy streaming STT namespace/routes are removed in hard cutover. |
-
-## Route Prefix Mapping
-
-| Prefix | Primary Namespace(s) | Expected Backend |
-|---|---|---|
-| `/api/warden/*` | secrets | `warden` |
-| `/api/guardian/*` | auth | `guardian` |
-| `/api/authority/*` | authority | `authority` |
-| `/api/platform/*` and `/svc/platform/*` | platform | `platform-worker` |
-| `/api/coder/*` and `/svc/coder/*` | coder | `coder-runtime` |
-| `/api/browser/*` | browser | `browser-worker` |
-| `/api/portal/*` | portal | `portal-worker` |
-| `/api/database/* and /api/provision/*` | db, ddl (builder + provisioning) | `db-worker` |
-| `/api/scribe/*` | secure, open | `scribe` |
-| `/api/smith/*` | ddl | `smith` |
-| `/api/redis/*` | redis | `redis-worker` |
-| `/api/b2/*` | files | `b2-worker` |
-| `/api/courier/*` | courier | `courier-worker` |
-| `/api/logs/*` | logs | `logs-worker` |
-| `/health`, `/v1/ping` | health | `gateway-local` |
-| `/api/admin/*` | admin | `admin-worker` |
-| `/api/sync/*` | sync | `sync-worker` |
-| `/api/job/*` | jobs | `job-worker` |
-| `/api/processor/*` | processor | `processor-service` |
-| `/api/artifact/*` | artifacts | `artifact-worker` |
-| `/svc/stash/tables/*` | stash.tables | `stash-worker` |
-| `/api/rag/*, /api/agent/*, /api/llm/*, /api/results/*, /api/orchestration/*, /api/session/*` | ai, ai.rag, ai.tools, ai.workflow, ai.results | `agent-runtime` |
-| `/api/workflow/*` | workflow | `workflow-manager` |
-| `/api/agent/stt` | ai.stt | `agent-runtime` |
-
-## Local and Helper Operations
-
-- `dominus.auth.validateJwt` performs local payload checks and expiry validation; it is not a full remote introspection endpoint.
-- `dominus.auth.getJwks` fetches and caches public signing keys from `/jwt/jwks`.
-- `dominus.health.check` uses direct `fetch` to the gateway `/health` route for low-level availability checks.
-- `dominus.ai.stt` sends binary audio to `POST /api/agent/stt` for batch transcription.
-- `dominus.authority.*` uses the cutover `appSlug` / `env` / `targetOrgId` / `targetAppSlug` / `targetEnv` vocabulary; `contextResolve()` and `mintSelectedScopeJwt()` now send the canonical `org_id` / `app_slug` / `env` and `target_org_id` / `target_env` wire payloads expected by live gateway routes.
-- `dominus.browser.*` routes through `/api/browser/*` with `useGateway: true`, producing authenticated gateway paths under `/svc/browser/*`. Browser run metadata remains worker runtime state; Artifact V2 is only for sanitized result/capture payloads.
-- `dominus.platform.*` and `dominus.coder.*` call `/svc/platform/*` and `/svc/coder/*` through `gatewayFetch`. Policy/Coder helpers accept actor context and forward it as `X-Actor-Type` / `X-Actor-Id`; `dominus.coder.ensureRun()` requires exactly one of `workflowRecipeRef` or `pipelineRecipeRef`.
-- Convenience wrappers like `dominus.courier.sendWelcome` delegate to core routes (for example `/api/courier/send`).
-
-## Coverage Notes
-
-- Gateway routing is enabled per method via `useGateway: true` in namespace implementations; direct calls still target `/api/*` and are transformed by the client when gateway mode is on.
-- The exhaustive per-command listing with params/returns/routes is documented in [usage-reference.md](./usage-reference.md).
+# Routes, Services, and Endpoints Assessment
+
+This assessment is derived from all public namespace methods under `src/namespaces/` and their configured routes in SDK request calls.
+
+Audited commands: **~450** (hand-counted) across **27** top-level namespace files in `src/namespaces/`. The Service Matrix below lists **29** namespace surfaces because it expands dotted sub-namespaces (e.g. `ai.*` and `auth.*`) into their own rows, so the surface count is intentionally higher than the file count, not a typo. These totals are hand-maintained — re-derive from source before quoting.
+
+## Service Matrix
+
+| Service | Commands | Namespaces | Distinct Route Expressions | Notes |
+|---|---:|---|---:|---|
+| `guardian` | 146 | dominus.auth | 146 | HTTP API routes via Dominus client. |
+| `agent-runtime` | 53 | dominus.ai, dominus.ai.artifacts, dominus.ai.rag, dominus.ai.results, dominus.ai.tools, dominus.ai.workflow | 51 | HTTP API routes via Dominus client. |
+| `workflow-manager` | 38 | dominus.workflow | 36 | HTTP API routes via Dominus client. |
+| `authority` | 33 | dominus.authority | 33 | Hard-cut app/org/env Authority surface. |
+| `platform-worker` | 16 | dominus.platform | 16 | Gateway `/svc/platform/*` group/repository policy surface; policy helpers accept actor attribution headers. |
+| `coder-runtime` | 11 | dominus.coder | 11 | Gateway `/svc/coder/*` run lifecycle surface; launch requires exactly one workflow or pipeline recipe ref. |
+| `browser-worker` | 11 | dominus.browser | 10 | Authenticated `/svc/browser/*` browser automation primitive; Cloudflare Browser Run default, Browserbase fallback. |
+| `portal-worker` | 22 | dominus.portal | 22 | HTTP API routes via Dominus client. |
+| `db-worker` | 20 | dominus.db, dominus.ddl | 19 | HTTP API routes via Dominus client. |
+| `smith` | 15 | dominus.ddl | 15 | HTTP API routes via Dominus client. |
+| `b2-worker` | 14 | dominus.files | 14 | HTTP API routes via Dominus client. |
+| `redis-worker` | 14 | dominus.redis | 14 | HTTP API routes via Dominus client. |
+| `logs-worker` | 9 | dominus.logs | 4 | HTTP API routes via Dominus client; tail filters include `machine_id`. |
+| `scribe` | 7 | dominus.secure | 7 | HTTP API routes via Dominus client. |
+| `job-worker` | 8 | dominus.jobs | 6 | HTTP API routes via Dominus client. |
+| `artifact-worker` | 6 | dominus.artifacts | 6 | HTTP API routes via Dominus client. |
+| `stash-worker` managed tables | 6 | dominus.stash.tables | 6 | Typed self/group table routes through the authenticated gateway. |
+| `admin-worker` | 5 | dominus.admin, dominus.files | 5 | HTTP API routes via Dominus client. |
+| `warden` | 4 | dominus.secrets | 1 | Selected-scope grant semantics live in this group. |
+| `courier-worker` | 5 | dominus.courier | 2 | HTTP API routes via Dominus client. |
+| `gateway-local` | 4 | dominus.auth, dominus.health | 3 | Gateway `/health`, `/v1/ping`, and `/jwt/jwks` helpers. |
+| `processor-service` | 3 | dominus.processor | 3 | HTTP API routes via Dominus client. |
+| `sync-worker` | 2 | dominus.sync | 2 | HTTP API routes via Dominus client. |
+| `local-jwt` | 1 | dominus.auth | 1 | Local JWT parsing/validation helpers in auth namespace. |
+| `retired-stt` | 0 | (retired) | 0 | Legacy streaming STT namespace/routes are removed in hard cutover. |
+
+## Route Prefix Mapping
+
+| Prefix | Primary Namespace(s) | Expected Backend |
+|---|---|---|
+| `/api/warden/*` | secrets | `warden` |
+| `/api/guardian/*` | auth | `guardian` |
+| `/api/authority/*` | authority | `authority` |
+| `/api/platform/*` and `/svc/platform/*` | platform | `platform-worker` |
+| `/api/coder/*` and `/svc/coder/*` | coder | `coder-runtime` |
+| `/api/browser/*` | browser | `browser-worker` |
+| `/api/portal/*` | portal | `portal-worker` |
+| `/api/database/* and /api/provision/*` | db, ddl (builder + provisioning) | `db-worker` |
+| `/api/scribe/*` | secure, open | `scribe` |
+| `/api/smith/*` | ddl | `smith` |
+| `/api/redis/*` | redis | `redis-worker` |
+| `/api/b2/*` | files | `b2-worker` |
+| `/api/courier/*` | courier | `courier-worker` |
+| `/api/logs/*` | logs | `logs-worker` |
+| `/health`, `/v1/ping` | health | `gateway-local` |
+| `/api/admin/*` | admin | `admin-worker` |
+| `/api/sync/*` | sync | `sync-worker` |
+| `/api/job/*` | jobs | `job-worker` |
+| `/api/processor/*` | processor | `processor-service` |
+| `/api/artifact/*` | artifacts | `artifact-worker` |
+| `/svc/stash/tables/*` | stash.tables | `stash-worker` |
+| `/api/rag/*, /api/agent/*, /api/llm/*, /api/results/*, /api/orchestration/*, /api/session/*` | ai, ai.rag, ai.tools, ai.workflow, ai.results | `agent-runtime` |
+| `/api/workflow/*` | workflow | `workflow-manager` |
+| `/api/agent/stt` | ai.stt | `agent-runtime` |
+
+## Local and Helper Operations
+
+- `dominus.auth.validateJwt` performs local payload checks and expiry validation; it is not a full remote introspection endpoint.
+- `dominus.auth.getJwks` fetches and caches public signing keys from `/jwt/jwks`.
+- `dominus.health.check` uses direct `fetch` to the gateway `/health` route for low-level availability checks.
+- `dominus.ai.stt` sends binary audio to `POST /api/agent/stt` for batch transcription.
+- `dominus.authority.*` uses the cutover `appSlug` / `env` / `targetOrgId` / `targetAppSlug` / `targetEnv` vocabulary; `contextResolve()` and `mintSelectedScopeJwt()` now send the canonical `org_id` / `app_slug` / `env` and `target_org_id` / `target_env` wire payloads expected by live gateway routes.
+- `dominus.browser.*` routes through `/api/browser/*` with `useGateway: true`, producing authenticated gateway paths under `/svc/browser/*`. Browser run metadata remains worker runtime state; Artifact V2 is only for sanitized result/capture payloads.
+- `dominus.platform.*` and `dominus.coder.*` call `/svc/platform/*` and `/svc/coder/*` through `gatewayFetch`. Policy/Coder helpers accept actor context and forward it as `X-Actor-Type` / `X-Actor-Id`; `dominus.coder.ensureRun()` requires exactly one of `workflowRecipeRef` or `pipelineRecipeRef`.
+- Convenience wrappers like `dominus.courier.sendWelcome` delegate to core routes (for example `/api/courier/send`).
+
+## Coverage Notes
+
+- Gateway routing is enabled per method via `useGateway: true` in namespace implementations; direct calls still target `/api/*` and are transformed by the client when gateway mode is on.
+- The exhaustive per-command listing with params/returns/routes is documented in [usage-reference.md](./usage-reference.md).