{ "openapi": "3.1.0", "info": { "title": "SigmaX Action Spine API", "version": "1.0.0", "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required · live_rails_reserved", "description": "The governed mandate-to-action system of record.\n\nBOUNDARIES (structural, not aspirational): this API is paper/draft-only. It records decisions and prepares dispositions (a paper track, an advisor task, a broker-handoff DRAFT, or a blocked outcome); it never transmits an order to a venue, custodies assets, transfers funds, sends externally, or creates customer eligibility. Human approval is required for capital-linked escalation. Live rails are reserved/blocked. Every success envelope carries no_capital_moved=true and live_execution_enabled=false.\n\nAUTH: durable (v2) routes require an Action Spine principal presented as `Authorization: Bearer ` (workspace + approver role). They are operator-gated and OFF by default (404 until armed). The stateless (v1) compute routes are pure preview and persist nothing.\n\nAI analyzes. Deterministic systems validate. Humans authorize. Capital remains governed." }, "servers": [ { "url": "https://api.sigmax.capital", "description": "Production (durable routes armed only when the operator enables them)" } ], "tags": [ { "name": "Durable lifecycle", "description": "The governed, persisted system of record (operator-gated, principal-required)." }, { "name": "Read surfaces", "description": "Workspace-scoped, principal-gated read-only inspection + audit surfaces." }, { "name": "Agent gateway", "description": "AI-Agent Guardrails: agents propose capital actions; SigmaX governs; humans authorize; capital remains governed." }, { "name": "Webhooks", "description": "Signed, non-authoritative event delivery. Default-off; SSRF-hardened endpoint validation; no capital moves." }, { "name": "Compute (stateless)", "description": "Pure compute previews; nothing is persisted." } ], "paths": { "/v1/trigger-engine/signals/create": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Build a Signal (stateless preview)", "description": "Pure compute; nothing is persisted. Seeds the lifecycle.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignalCreateRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithSignal" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/packets/create": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Build a Decision Packet (stateless preview)", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PacketCreateRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDecisionPacket" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/mandates/check": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Recompute a mandate check (stateless preview)", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/create": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Build an ActionIntent (stateless preview)", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/preflight/run": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Run preflight (stateless preview)", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/approval/request": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Compute an approval request (stateless preview)", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/router/prepare-handoff": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Prepare a route handoff DRAFT (stateless preview) — never sends an order", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/paper/submit": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Record a PAPER observation (stateless preview) — no live order", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/impact/record": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Compute an impact record (stateless preview)", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/drift/monitor": { "post": { "tags": [ "Compute (stateless)" ], "summary": "Compute a drift observation (stateless preview)", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/mandates/register": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Register a CapitalMandate (versioned, provenance-hashed)", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MandateRegisterRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/MandateRegistered" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/action-intents/create": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Create a durable ActionIntent (idempotent, workspace-scoped)", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required. The workspace + actor come from the verified principal, never the body.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DurableCreateRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required", "parameters": [ { "name": "Idempotency-Key", "in": "header", "required": false, "description": "Stripe-style idempotency key. Takes precedence over the idempotency_key body field; if both are present and differ the request is refused (invalid_request). The same key + same semantic payload returns the existing ActionIntent; the same key + a different payload is blocked_idempotency_payload_mismatch. Workspace-scoped.", "schema": { "type": "string" } } ] } }, "/v1/trigger-engine/durable/preflight/run": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Run preflight on a persisted ActionIntent", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionIntentIdRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/approval/request": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Request approval on a persisted ActionIntent", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionIntentIdRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/approval/record": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Record an approval decision (legacy body form; identity from the verified principal)", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required. Requires a full approval_event object (validated server-side). Prefer POST /approvals/{id}/decision, which builds the ApprovalEvent from the verified principal.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalRecordRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/router/prepare-handoff": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Prepare a route handoff DRAFT (paper / advisor task / broker-handoff draft / blocked) — never sends", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RouterPrepareRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/paper/open": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Open a PAPER observation (no live order, no capital)", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaperOpenRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/impact/record": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Record a capital-impact observation (expected vs observed; no ROI claim)", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImpactRecordRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/drift/monitor": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Record a drift observation on a persisted ActionIntent", "description": "Persists an append-only lifecycle event. Operator-gated (default-off) and principal-required.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DriftMonitorRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/{id}/route-deliverables": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Prepare a NON-LIVE route deliverable (advisor task or broker-handoff DRAFT)", "description": "The first real non-live operational output. When an ActionIntent has been mandate-checked, preflighted, compliance-gated, and (for a handoff) human-authorized, SigmaX prepares a DRAFT artifact — an advisor task or a broker-handoff DRAFT — summarizing the governed chain. A DRAFT is NOT a delivery rail: it is never transmitted, never submitted, and moves no capital. Eligibility is INHERITED from the persisted governed RouteInstruction (which could only exist because mandate + preflight + compliance + recorded-approval gates passed at prepare-handoff), so the deliverable re-opens no gate. route_type is SERVER-DERIVED from the persisted route (advisor_task | broker_handoff_draft) — never a body claim; an ineligible route yields a blocked disposition and persists nothing. Every deliverable carries no_capital_moved=true and live_execution_enabled=false.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true, "description": "No body fields are required; the deliverable is derived entirely from the persisted, governed lifecycle." } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/RouteDeliverableCreated" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" }, "get": { "tags": [ "Read surfaces" ], "summary": "The intent’s route deliverables (advisor tasks / broker-handoff drafts)", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/RouteDeliverablesPage" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/compliance-checks/record": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Record a compliance check result for an ActionIntent (attributed claim; gating recomputes at preflight)", "description": "SigmaX ORCHESTRATES AND RECORDS compliance checks; it does not perform them. The recorded result is an ATTRIBUTED CLAIM under the verified principal — `provider` is a recorded source label, never a call target (SigmaX performs no provider call); the regulated firm, its compliance team, and its connected providers remain the authority of record. Recording NEVER transitions the lifecycle and never approves anything: preflight recomputes the gate server-side (a required check that is missing, failed, stale against the SERVER clock, or needs human review blocks or holds the route), and the append-only reducer refuses route preparation past an unmet requirement. Timestamps are SERVER-stamped. Requirements come from the registered CapitalMandate’s required_compliance_checks, persisted with the mandate_checked event — never from the request.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceCheckRecordRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ComplianceCheckRecorded" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/embed-sessions/issue": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Issue a scoped, short-lived embed-approval session for the caller's workspace", "description": "A workspace principal (Bearer api-key) mints a SCOPED embed-approval session to hand to a partner embed. The session acts AS the minting principal (workspace + principal_id + role from the VERIFIED principal, never the body); scope is always approval_inbox; TTL is clamped short-lived. The token is returned ONCE (only a one-way hash is stored). A scoped SESSION principal is denied here (it cannot mint another session). Default-off: 404 until SIGMAX_EMBED_APPROVAL_SESSIONS_ENABLED=on.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmbedSessionIssueRequest" } } } }, "responses": { "200": { "description": "Success — a scoped session was issued; the token is shown once.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/EmbedSessionIssueResult" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "403": { "description": "Forbidden — a scoped session principal cannot mint a session (scope_not_permitted).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "The embed-approval-session surface is not armed (default-off).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · scoped_credential · default_off" } }, "/v1/trigger-engine/embed-sessions": { "get": { "tags": [ "Read surfaces" ], "summary": "List the caller workspace's embed-approval sessions (secret-free)", "description": "Read-only; principal-gated + workspace-scoped. Returns the safe view (no token, no hash) of every embed session in the caller's workspace. Default-off: 404 until armed.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/EmbedSessionListResult" } } } ] } } } }, "400": { "description": "Blocked.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "403": { "description": "Forbidden — a scoped session cannot list sessions.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "The surface is not armed (default-off).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · read_only" } }, "/v1/trigger-engine/embed-sessions/{id}/revoke": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Revoke an embed-approval session in the caller's workspace", "description": "Workspace-fenced: only a session in the caller's OWN workspace is revoked (a foreign/unknown/already-revoked id returns revoked:false — no cross-workspace oracle). Idempotent. Default-off: 404 until armed.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Embed session id (workspace-scoped)." } ], "responses": { "200": { "description": "Success — revoked is true only if an active session in the caller's workspace was revoked.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/EmbedSessionRevokeResult" } } } ] } } } }, "400": { "description": "Blocked.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "403": { "description": "Forbidden — a scoped session cannot revoke sessions.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "The surface is not armed (default-off).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · scoped_credential · default_off" } }, "/v1/trigger-engine/durable/producers/route-feasibility/run": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Run the route-feasibility ComplianceCheck producer (dry-run by default; records a custom_policy check)", "description": "Compute-then-record: the deterministic route-friction evaluator assesses the supplied route inputs (requested_rail + estimated cost bps vs ceiling, pricing-data freshness, size vs route capacity) for an EXISTING ActionIntent and produces a single custom_policy ComplianceCheck. SigmaX RECORDS an attributed claim under the verified principal — it VERIFIES nothing, prices no live venue, and moves no capital; the provider is a recorded label (sigmax_route_feasibility_policy). Numeric inputs are caller-supplied friction estimates; an absent/malformed value leaves that dimension unassessed (deny-by-default: an unassessable route records status \"unavailable\", never \"pass\"; infeasible -> \"fail\"; friction_review -> \"needs_review\"; feasible -> \"pass\"). Doubly operator-gated (durable surface + producer flag); persistence additionally requires the producer ARMED flag — until then the route returns the full plan and persists nothing. Recording a check NEVER transitions the lifecycle; gating recomputes server-side at preflight. Workspace + actor come from the verified principal.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RouteFeasibilityProducerRunRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/RouteFeasibilityProducerRunResult" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or the route-feasibility producer flag), or the action intent is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · records_not_verifies · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/producers/instrument-access/run": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Run the instrument-access ComplianceCheck producer (dry-run by default; records a custom_policy check)", "description": "Compute-then-record: the deterministic instrument-access policy engine evaluates (venue_id, instrument_family, requested_mode) for an EXISTING ActionIntent and produces a single custom_policy ComplianceCheck. SigmaX RECORDS an attributed claim under the verified principal — it VERIFIES nothing; the provider is a recorded label (sigmax_instrument_access_policy) and no external provider is called. An unknown venue/family is denied-by-default (status \"unavailable\", never \"pass\"). Doubly operator-gated (durable surface + producer flag); persistence additionally requires the producer ARMED flag — until then the route returns the full plan and persists nothing. Recording a check NEVER transitions the lifecycle and never approves anything; gating recomputes server-side at preflight. Workspace + actor come from the verified principal.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InstrumentAccessProducerRunRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/InstrumentAccessProducerRunResult" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or the instrument-access producer flag), or the action intent is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · records_not_verifies · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/producers/fiduciary-drift/run": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Run the fiduciary-drift signal producer (dry-run by default; stops at human review)", "description": "The first real signal producer weld: the caller’s committed-vs-observed mandate envelopes feed the deterministic fiduciary drift engine; each REAL, provenanced breach becomes a Signal + Decision Packet + ActionIntent candidate whose derived status REQUIRES a human (needs_approval or stricter) — then STOPS. The producer never runs preflight, never records an approval, never prepares a route; an unprovenanced or in-envelope row produces NOTHING. Doubly operator-gated (producer flag + durable surface); persistence additionally requires the producer ARMED flag — until then the route returns the full dry-run plan and persists nothing. Registered mandates only. Workspace + actor come from the verified principal.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FiduciaryDriftProducerRunRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/FiduciaryDriftProducerRunResult" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/durable/producers/thesis/run": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Run the thesis signal producer (dry-run by default; stops at human review)", "description": "The second signal producer weld: a CONFIRMED, out-of-sample-gate-passed ClientThesis (Knowledge Galaxy) becomes a Signal + Decision Packet + ActionIntent candidate whose derived status REQUIRES a human — then STOPS. A thesis is a VIEW, not a position: the proposed move is UNSIZED (null notional) and a non-capital-linked watchlist candidate — never a sized recommendation. Only status=confirmed AND oos_gate_passed=true produce; every other thesis produces NOTHING (a thesis whose provenance declares sample/demo evidence is refused). Doubly operator-gated (producer flag + durable surface); persistence additionally requires the producer ARMED flag — until then the route returns the full dry-run plan and persists nothing. Registered mandates only. Workspace + actor come from the verified principal.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ThesisProducerRunRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ThesisProducerRunResult" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/approvals/{id}/decision": { "post": { "tags": [ "Durable lifecycle" ], "summary": "Record a human approval decision under the caller’s OWN principal", "description": "The ApprovalEvent (role, actor, approved version, evidence hash) is built ENTIRELY server-side from the verified principal + persisted lifecycle; the body supplies only the decision verb + explicit risk acknowledgements. Records INTENT only — no order is sent, no capital moves.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped) — the decision is recorded against this intent’s pending approval request. A foreign id answers exactly like an absent one." } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalDecisionRequest" } } } }, "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithDurable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/status": { "get": { "tags": [ "Read surfaces" ], "summary": "Trigger engine status (open, no auth)", "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents": { "get": { "tags": [ "Read surfaces" ], "summary": "List ActionIntents in the workspace", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "status", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "mandate_id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "route", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "approval_state", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "created_after", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "created_before", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 } }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "default": 0 } }, { "name": "cursor", "in": "query", "required": false, "description": "Opaque keyset cursor (Stripe-style). When set it SUPERSEDES offset: results are ordered by an immutable, unique total order and the page starts just after the cursor position (dup/skip-free). Pass back the previous page next_cursor; hold the other filters constant (a filter change with an old cursor is rejected 400). A malformed/tampered/foreign cursor is rejected 400.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ActionIntentListPage" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/{id}": { "get": { "tags": [ "Read surfaces" ], "summary": "Get one ActionIntent’s current summary", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithActionIntentSummary" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/{id}/replay": { "get": { "tags": [ "Read surfaces" ], "summary": "Replay the full append-only lifecycle", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithReplay" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/{id}/inspect": { "get": { "tags": [ "Read surfaces" ], "summary": "Operator inspection surface (status, verdicts, event log, proof-chain completeness)", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/{id}/events": { "get": { "tags": [ "Read surfaces" ], "summary": "List the append-only lifecycle events", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithEvents" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/{id}/impact": { "get": { "tags": [ "Read surfaces" ], "summary": "List impact records for one ActionIntent", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithImpactRecords" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/{id}/audit": { "get": { "tags": [ "Read surfaces" ], "summary": "The immutable audit trail for one ActionIntent", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." }, { "name": "event_type", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "created_after", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "created_before", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 } }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AuditPage" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/action-intents/{id}/evidence-map": { "get": { "tags": [ "Read surfaces" ], "summary": "The intent’s auditor evidence map (Proof Product) — a deterministic read-only lifecycle projection", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle). Projects the durable lifecycle into the auditor/compliance record: decision, mandate, recorded compliance claims, preflight, approval chain, route DRAFT disposition, (never-live) impact, hash-chained timeline, and a derived exceptions section whose `clean` is true ONLY when the lifecycle is fully satisfied end-to-end. Records-only: authorizes nothing, moves no capital.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "required": [ "evidence_map" ], "properties": { "evidence_map": { "$ref": "#/components/schemas/ActionIntentEvidenceMap" } } } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "The durable surface is not armed, or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · read_only_projection · records_not_authorizes" } }, "/v1/trigger-engine/action-intents/{id}/compliance-checks": { "get": { "tags": [ "Read surfaces" ], "summary": "The intent’s recorded compliance checks + the mandate’s requirement", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "ActionIntent id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ComplianceChecksPage" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/route-deliverables/{id}": { "get": { "tags": [ "Read surfaces" ], "summary": "One route deliverable by its own id (workspace-scoped; a foreign or absent id answers identically: 400 blocked_missing_action_intent — no cross-workspace oracle)", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Route deliverable id (workspace-scoped)." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WithRouteDeliverable" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/mandates/{id}/versions/{version}": { "get": { "tags": [ "Read surfaces" ], "summary": "Resolve a specific mandate version (provenance-verified)", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Mandate id." }, { "name": "version", "in": "path", "required": true, "schema": { "type": "integer" }, "description": "Mandate version." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/mandates/{id}": { "get": { "tags": [ "Read surfaces" ], "summary": "List all versions of a mandate", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Mandate id." } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/mandates/{id}/action-intents": { "get": { "tags": [ "Read surfaces" ], "summary": "List ActionIntents under one mandate", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Mandate id." }, { "name": "status", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "route", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "approval_state", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "created_after", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "created_before", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 } }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "default": 0 } }, { "name": "cursor", "in": "query", "required": false, "description": "Opaque keyset cursor (Stripe-style). When set it SUPERSEDES offset: results are ordered by an immutable, unique total order and the page starts just after the cursor position (dup/skip-free). Pass back the previous page next_cursor; hold the other filters constant (a filter change with an old cursor is rejected 400). A malformed/tampered/foreign cursor is rejected 400.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ActionIntentListPage" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/impact-ledger": { "get": { "tags": [ "Read surfaces" ], "summary": "The workspace Impact Ledger (expected vs observed; evidence-class tagged; no fabricated ROI)", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "intent_id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "category", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "evidence_class", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "created_after", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "created_before", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 } }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "default": 0 } }, { "name": "cursor", "in": "query", "required": false, "description": "Opaque keyset cursor returned as next_cursor; supersedes offset when present.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ImpactLedgerPage" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/audit": { "get": { "tags": [ "Read surfaces" ], "summary": "The workspace-scoped immutable audit stream", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "event_type", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "action_intent_id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "mandate_id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "created_after", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "created_before", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 } }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "default": 0 } }, { "name": "cursor", "in": "query", "required": false, "description": "Opaque keyset cursor (Stripe-style). When set it SUPERSEDES offset: results are ordered by an immutable, unique total order and the page starts just after the cursor position (dup/skip-free). Pass back the previous page next_cursor; hold the other filters constant (a filter change with an old cursor is rejected 400). A malformed/tampered/foreign cursor is rejected 400.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AuditPage" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/compliance/verify": { "get": { "tags": [ "Read surfaces" ], "summary": "ComplianceCheck-drift audit for the workspace", "description": "Read-only; principal-gated + workspace-scoped. Audits each ActionIntent's recorded compliance posture for DRIFT from what its mandate requires and from what Preflight concluded (deny-by-default: a required check with no fresh pass is drift). Governed, paper/draft-only — SigmaX never transmits an order to a venue; no capital moved; live execution disabled.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "404": { "description": "Durable lifecycle routes are disabled (operator has not armed SIGMAX_TRIGGER_ENGINE_DURABLE_ENABLED).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/mandates/verify": { "get": { "tags": [ "Read surfaces" ], "summary": "Mandate-registry integrity audit for the workspace", "description": "Read-only; principal-gated + workspace-scoped. Recomputes governed integrity over the CapitalMandate registry backing this workspace's ActionIntents: provenance recompute-vs-hash, envelope/body version agreement, no-capital authority, and duplicate-provenance detection. Governed, paper/draft-only — SigmaX never transmits an order to a venue; no capital moved; live execution disabled.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "404": { "description": "Durable lifecycle routes are disabled (operator has not armed SIGMAX_TRIGGER_ENGINE_DURABLE_ENABLED).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/operator-brief": { "get": { "tags": [ "Read surfaces" ], "summary": "Capital Action OS operator brief — governed pipeline-state digest for the workspace", "description": "Read-only; principal-gated + workspace-scoped. Folds this workspace's governed ActionIntent lifecycle into one operator digest: candidates by status and by route disposition, pending human approvals, blocked/watchlist/paper tallies, and open drift alerts. Governed, paper/draft-only — SigmaX never transmits an order to a venue; no capital moved; live execution disabled.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "404": { "description": "Durable lifecycle routes are disabled (operator has not armed SIGMAX_TRIGGER_ENGINE_DURABLE_ENABLED).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/approvals/pending": { "get": { "tags": [ "Read surfaces" ], "summary": "List decisions awaiting human authorization in the workspace", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/approvals/principal": { "get": { "tags": [ "Read surfaces" ], "summary": "Identity echo — the authenticated principal (workspace, role, id; no secret)", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent — no cross-workspace oracle).", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WhoAmI" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag, or a route-specific flag such as the signal-producer flag), or the resource is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/agent-gateway/candidates": { "get": { "tags": [ "Agent Action Gateway" ], "summary": "List the workspace's agent-proposed candidates, classified into the human-gated queue", "description": "Read-only; principal-gated + workspace-scoped. Classifies agent-proposed candidates into reserved-for-operator / actionable / blocked / needs-upstream-evidence (deny-by-default: an unrecognized verdict routes to the operator). Agents propose only — this route approves nothing, executes nothing, and moves no capital.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/GatewayEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "additionalProperties": true } } } ] } } } }, "404": { "description": "The Agent Action Gateway is operator-gated and disabled by default (arm with SIGMAX_AGENT_ACTION_GATEWAY_ENABLED=on).", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } } } } }, "/v1/agent-gateway/proposals": { "post": { "tags": [ "Agent gateway" ], "summary": "Submit an agent-proposed capital action (proposal only — no authority granted)", "description": "An AI agent (or any non-human system) submits a proposed capital action. SigmaX records it and returns the allowed/blocked capability posture. Agents may PROPOSE, draft, simulate, and request review — they can NEVER approve, reject, execute, change a mandate, route live, or move funds — capital remains governed. A request for a FORBIDDEN capability fails closed and is audited. `agent_provider_label` + *_hash fields are attribution only (SigmaX verifies no provider claim and stores hashes/refs, never raw prompts, tool payloads, or credentials — a raw prompt/credential field is refused). Operator-gated (default-off), principal-required. No capital moved.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentProposalRequest" } } } }, "responses": { "200": { "description": "Success — governed, non-live. Agents propose; SigmaX governs; humans authorize. No capital moved.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/GatewayEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentProposalReceived" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request, or a forbidden agent capability was requested (fails closed + audited).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } }, "404": { "description": "The Agent Action Gateway is operator-gated and OFF by default (SIGMAX_AGENT_ACTION_GATEWAY_ENABLED), or the proposal is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/agent-gateway/proposals/{id}": { "get": { "tags": [ "Agent gateway" ], "summary": "Get an agent proposal + its evaluations", "description": "Read-only; principal-gated + workspace-scoped (a foreign proposal is indistinguishable from an absent one).", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Agent proposal id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, non-live. Agents propose; SigmaX governs; humans authorize. No capital moved.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/GatewayEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentProposalView" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request, or a forbidden agent capability was requested (fails closed + audited).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } }, "404": { "description": "The Agent Action Gateway is operator-gated and OFF by default (SIGMAX_AGENT_ACTION_GATEWAY_ENABLED), or the proposal is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/agent-gateway/proposals/{id}/evaluate": { "post": { "tags": [ "Agent gateway" ], "summary": "Evaluate a proposal through the governed chain (may create a DRAFT ActionIntent — human-gated)", "description": "Runs the proposal through the SAME governed Action Spine. When it references a REGISTERED mandate, a DRAFT ActionIntent is created (origin=agent_proposal, unsized, zero-evidence) that CANNOT advance without a human running preflight, approving if required, and preparing any route — the agent gains no approver identity (the lifecycle actor is a SYSTEM actor, never a human approver). The evaluation reports the mandate verdict, the allowed/blocked agent capabilities, and the required HUMAN action. No capital moves; nothing is transmitted.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Agent proposal id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "runtime": { "type": "object", "additionalProperties": true, "description": "Optional runtime claim — every field is optional on this route (the server fills honest defaults: the three gate booleans default true, numeric measurements null). See RuntimeContextRequest for the full field set." } }, "additionalProperties": true } } } }, "responses": { "200": { "description": "Success — governed, non-live. Agents propose; SigmaX governs; humans authorize. No capital moved.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/GatewayEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentEvaluationResult" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request, or a forbidden agent capability was requested (fails closed + audited).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } }, "404": { "description": "The Agent Action Gateway is operator-gated and OFF by default (SIGMAX_AGENT_ACTION_GATEWAY_ENABLED), or the proposal is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/agent-gateway/proposals/{id}/audit": { "get": { "tags": [ "Agent gateway" ], "summary": "The proposal’s append-only audit trail (hashes/refs only, no secrets)", "description": "Read-only; principal-gated + workspace-scoped. Records agent_proposal_received/evaluated, agent_forbidden_capability_blocked, agent_actionintent_created, agent_human_review_requested — value-free (agent id / run id / hashes / summary), never prompt bodies, tool payloads, or credentials.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Agent proposal id (workspace-scoped; a foreign id answers exactly like an absent one)." } ], "responses": { "200": { "description": "Success — governed, non-live. Agents propose; SigmaX governs; humans authorize. No capital moved.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/GatewayEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentAuditPage" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request, or a forbidden agent capability was requested (fails closed + audited).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } }, "404": { "description": "The Agent Action Gateway is operator-gated and OFF by default (SIGMAX_AGENT_ACTION_GATEWAY_ENABLED), or the proposal is not in the caller’s workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/action-spine/webhooks/subscriptions": { "post": { "tags": [ "Webhooks" ], "summary": "Register a signed webhook subscription (delivery default-off)", "description": "Registers an HTTPS endpoint to receive signed, non-authoritative event records. The endpoint_url is validated by an SSRF-hardened gate (HTTPS-only; credentials-in-URL, private/loopback/link-local/CGNAT/metadata targets refused; a hostname that resolves to a private address is refused at delivery time). The HMAC signing secret is returned ONCE as secret_plaintext_once and never again by any read route. Delivery is off until an operator sets SIGMAX_WEBHOOK_DELIVERY_ENABLED; registration itself sends nothing and no capital moves. Principal-required, workspace-scoped; create/pause/revoke are recorded on the append-only audit trail (value-free).", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookSubscriptionRequest" } } } }, "responses": { "201": { "description": "Created — subscription registered; signing secret shown once.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/WebhookEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookSubscriptionCreated" } } } ] } } } }, "400": { "description": "Blocked — invalid request, or an endpoint_url refused by the SSRF-hardened gate (non-HTTPS / credentials / private / loopback / metadata target).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "404": { "description": "No such subscription/delivery in the caller’s workspace (a foreign resource is indistinguishable from absent).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "409": { "description": "The subscription is not active (a delivery can only be replayed for an active subscription).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" }, "get": { "tags": [ "Webhooks" ], "summary": "List webhook subscriptions", "description": "Read-only; principal-gated + workspace-scoped. The signing secret is never returned (only secret_prefix).", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, non-live. Signed webhooks; delivery is default-off; no capital moves.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/WebhookEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookSubscriptionList" } } } ] } } } }, "400": { "description": "Blocked — invalid request, or an endpoint_url refused by the SSRF-hardened gate (non-HTTPS / credentials / private / loopback / metadata target).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "404": { "description": "No such subscription/delivery in the caller’s workspace (a foreign resource is indistinguishable from absent).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "409": { "description": "The subscription is not active (a delivery can only be replayed for an active subscription).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/action-spine/webhooks/subscriptions/{id}/pause": { "post": { "tags": [ "Webhooks" ], "summary": "Pause a subscription (delivery stops until resumed)", "description": "Sets status=paused. Recorded on the append-only audit trail. Principal-required, workspace-scoped.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Webhook subscription id (workspace-scoped)." } ], "responses": { "200": { "description": "Success — governed, non-live. Signed webhooks; delivery is default-off; no capital moves.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/WebhookEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookSubscriptionOne" } } } ] } } } }, "400": { "description": "Blocked — invalid request, or an endpoint_url refused by the SSRF-hardened gate (non-HTTPS / credentials / private / loopback / metadata target).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "404": { "description": "No such subscription/delivery in the caller’s workspace (a foreign resource is indistinguishable from absent).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "409": { "description": "The subscription is not active (a delivery can only be replayed for an active subscription).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/action-spine/webhooks/subscriptions/{id}": { "delete": { "tags": [ "Webhooks" ], "summary": "Revoke (soft-delete) a subscription", "description": "Sets status=revoked; delivery stops permanently. Recorded on the append-only audit trail. Principal-required, workspace-scoped.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Webhook subscription id (workspace-scoped)." } ], "responses": { "200": { "description": "Success — governed, non-live. Signed webhooks; delivery is default-off; no capital moves.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/WebhookEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookSubscriptionOne" } } } ] } } } }, "400": { "description": "Blocked — invalid request, or an endpoint_url refused by the SSRF-hardened gate (non-HTTPS / credentials / private / loopback / metadata target).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "404": { "description": "No such subscription/delivery in the caller’s workspace (a foreign resource is indistinguishable from absent).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "409": { "description": "The subscription is not active (a delivery can only be replayed for an active subscription).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/action-spine/webhooks/deliveries": { "get": { "tags": [ "Webhooks" ], "summary": "List webhook deliveries", "description": "Read-only; principal-gated + workspace-scoped. Filter by subscription_id and/or delivery status. Delivery records carry only payload_hash, never the event payload body.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "subscription_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Filter to one subscription." }, { "name": "status", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "pending", "delivered", "failed", "retrying", "dead_lettered" ] }, "description": "Filter by delivery status." } ], "responses": { "200": { "description": "Success — governed, non-live. Signed webhooks; delivery is default-off; no capital moves.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/WebhookEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookDeliveryList" } } } ] } } } }, "400": { "description": "Blocked — invalid request, or an endpoint_url refused by the SSRF-hardened gate (non-HTTPS / credentials / private / loopback / metadata target).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "404": { "description": "No such subscription/delivery in the caller’s workspace (a foreign resource is indistinguishable from absent).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "409": { "description": "The subscription is not active (a delivery can only be replayed for an active subscription).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/action-spine/webhooks/deliveries/drain": { "post": { "tags": [ "Webhooks" ], "summary": "Run one webhook delivery drain pass (sends only when operator-enabled)", "description": "Sends every DUE delivery (backoff elapsed, still open, attempts remaining) for the CALLER'S workspace through the SSRF-hardened per-send worker. Operator-invoked, not scheduled. Fail-closed: when delivery is off (SIGMAX_WEBHOOK_DELIVERY_ENABLED) nothing is sent and status is queued_delivery_disabled. Backoff, dead-lettering, and the SSRF gate apply per send. At-least-once. No capital moves.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — a drain summary (counts only), governed and non-live. Delivery is default-off; no capital moves.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/WebhookEnvelope" }, { "type": "object", "properties": { "data": { "type": "object", "properties": { "summary": { "type": "object", "nullable": true, "description": "Null when delivery is disabled; otherwise per-pass counts.", "properties": { "attempted": { "type": "integer" }, "delivered": { "type": "integer" }, "retrying": { "type": "integer" }, "dead_lettered": { "type": "integer" }, "endpoint_rejected": { "type": "integer" }, "subscription_not_active": { "type": "integer" }, "not_found": { "type": "integer" }, "skipped": { "type": "integer" }, "delivery_enabled": { "type": "boolean" }, "no_capital_moved": { "type": "boolean" }, "live_execution_enabled": { "type": "boolean" } } }, "delivery_enabled": { "type": "boolean" }, "delivery_flag": { "type": "string" } } } } } ] } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } } } } }, "/v1/action-spine/webhooks/deliveries/{id}/replay": { "post": { "tags": [ "Webhooks" ], "summary": "Manually replay a delivery (sends only when operator-enabled)", "description": "Re-queues a delivery for an ACTIVE subscription. It is actually sent only when delivery is explicitly enabled (SIGMAX_WEBHOOK_DELIVERY_ENABLED); otherwise it is queued and worker_status is skipped_disabled. The SSRF gate + redirect refusal + timeout apply to every send. No capital moves.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "Webhook delivery id (workspace-scoped)." } ], "responses": { "200": { "description": "Success — governed, non-live. Signed webhooks; delivery is default-off; no capital moves.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/WebhookEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookDeliveryReplayed" } } } ] } } } }, "400": { "description": "Blocked — invalid request, or an endpoint_url refused by the SSRF-hardened gate (non-HTTPS / credentials / private / loopback / metadata target).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal is required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "404": { "description": "No such subscription/delivery in the caller’s workspace (a foreign resource is indistinguishable from absent).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } }, "409": { "description": "The subscription is not active (a delivery can only be replayed for an active subscription).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · paper_draft_only · human_approval_required" } }, "/v1/trigger-engine/audit/verify": { "get": { "tags": [ "Read surfaces" ], "summary": "Recompute-on-read audit provenance + completeness verification", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent). Recomputes each lifecycle event's stored payload hash and checks per-intent version completeness over the caller's OWN audit stream — no capital movement, no state change. Findings carry hashes only, never raw payloads. First-class audit_event rows are reported as not-recomputable, never silently counted as verified. Not a temporal-order proof (created_at is caller-assertable) and not the full lifecycle prev_hash chain validator; lifecycle replay validates those links separately.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AuditVerification" } } } ] } } } }, "400": { "description": "Blocked — a governance/validation gate refused the request (see error.code / reason_codes).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag), or the resource is not in the caller's workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · read_only · workspace_scoped · human_approval_required" } }, "/v1/trigger-engine/audit/export.csv": { "get": { "tags": [ "Read surfaces" ], "summary": "Export the workspace audit stream as CSV", "description": "Read-only; principal-gated + workspace-scoped. Returns the caller's OWN audit stream as a deterministic, injection-safe CSV attachment (text/csv) — no capital movement, no state change. Value-free by construction: every column is an enum, hash, server-minted id, ISO timestamp, or boolean; raw payloads are never included (they are hashed into provenance_hash). Cells are RFC-4180 quoted and formula-injection neutralized. Unpaginated (the full workspace stream).", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — a governed, read-only CSV attachment. No capital moved; live execution disabled.", "headers": { "Content-Disposition": { "description": "attachment; filename=\"sigmax-audit-export.csv\"", "schema": { "type": "string" } } }, "content": { "text/csv": { "schema": { "type": "string" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "The durable surface is not armed (default-off), or the resource is not in the caller's workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · read_only · workspace_scoped · human_approval_required" } }, "/v1/trigger-engine/impact-ledger/verify": { "get": { "tags": [ "Read surfaces" ], "summary": "Integrity verification of the workspace Impact Ledger", "description": "Read-only; principal-gated + workspace-scoped (a foreign resource is indistinguishable from absent). Checks the governed invariants the Impact Ledger must always hold over the caller's OWN rows — no capital movement, no state change. An ImpactRecord carries no stored provenance hash, so this is NOT a recompute-vs-hash proof (unlike /audit/verify): it flags capital-safety label violations (no_capital_moved must be true, live_execution_enabled must be false), a missing or unknown evidence_class (unlabeled ROI), non-finite money amounts, an intent_id that disagrees with the ledger entry, duplicate impact_record_id values (the id is a content hash and is not unique by construction), and orphan records referencing an intent with no lifecycle event in the workspace. Findings are value-free (ids, a field name, or a count only — never a money value or free text). Not a net-performance re-derivation (the record carries categorized impact estimates, not a gross/fees/net decomposition) and not a temporal-order proof.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — governed, paper/draft-only. No capital moved; live execution disabled.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/TriggerEnvelope" }, { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ImpactLedgerVerification" } } } ] } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "An operator-gated surface is not armed (default-off: the durable surface flag), or the resource is not in the caller's workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · read_only · workspace_scoped · human_approval_required" } }, "/v1/trigger-engine/impact-ledger/export.csv": { "get": { "tags": [ "Read surfaces" ], "summary": "Export the workspace Impact Ledger as CSV", "description": "Read-only; principal-gated + workspace-scoped. Returns the caller's OWN Impact Ledger as a deterministic, injection-safe CSV attachment (text/csv) — no capital movement, no state change. Money columns are raw numbers (negatives preserved); free-text evidence columns are RFC-4180 quoted and formula-injection neutralized; the governed labels (no_capital_moved, live_execution_enabled) and evidence_class are columns so no ROI is unlabeled. Unpaginated (the full workspace ledger).", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Success — a governed, read-only CSV attachment. No capital moved; live execution disabled.", "headers": { "Content-Disposition": { "description": "attachment; filename=\"sigmax-impact-ledger-export.csv\"", "schema": { "type": "string" } } }, "content": { "text/csv": { "schema": { "type": "string" } } } }, "401": { "description": "Unauthenticated — a valid Action Spine principal (Bearer key) is required on armed durable routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } }, "404": { "description": "The durable surface is not armed (default-off), or the resource is not in the caller's workspace.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerErrorEnvelope" } } } } }, "x-sigmax-authority": "no_capital · no_execution · no_external_send · read_only · workspace_scoped · human_approval_required" } } }, "components": { "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer", "description": "Action Spine principal API key (workspace + approver role)." } }, "schemas": { "ReasonCode": { "type": "string", "enum": [ "allowed", "paper_only", "handoff_ready", "approval_required", "blocked_missing_mandate", "blocked_missing_decision_packet", "blocked_missing_action_intent", "blocked_missing_approval", "blocked_missing_preflight", "blocked_preflight_failed", "blocked_halt_active", "blocked_asset_not_allowed", "blocked_action_not_allowed", "blocked_route_not_supported", "blocked_live_execution_disabled", "blocked_missing_evidence", "blocked_missing_counter_evidence", "blocked_liquidity_check", "blocked_risk_limit", "blocked_no_capital_authority", "blocked_id_mismatch", "blocked_idempotency_payload_mismatch", "blocked_invalid_transition", "blocked_unsupported_adapter", "blocked_compliance_check", "compliance_review_required", "blocked_role_not_permitted", "blocked_role_limit_exceeded" ], "description": "Closed set of governance reason codes." }, "Authority": { "type": "object", "description": "Locked authority posture — no capital, no execution, no external send, no customer action.", "properties": { "capital_authority": { "type": "string", "enum": [ "none" ] }, "execution_authority": { "type": "boolean", "enum": [ false ] }, "external_send": { "type": "boolean", "enum": [ false ] }, "customer_action": { "type": "boolean", "enum": [ false ] }, "customer_eligibility": { "type": "string", "enum": [ "not_customer_eligible" ] }, "broker_submit_path": { "type": "string", "enum": [ "none" ] }, "provider_calls": { "type": "string", "enum": [ "not_called" ] }, "secrets_policy": { "type": "string", "enum": [ "names_only" ] } }, "required": [ "capital_authority", "execution_authority", "external_send", "customer_action", "customer_eligibility", "broker_submit_path", "provider_calls", "secrets_policy" ] }, "TriggerEnvelope": { "type": "object", "required": [ "ok", "data", "status", "reason_codes", "no_capital_moved", "live_execution_enabled" ], "description": "The uniform Action Spine success envelope. Read no_capital_moved / live_execution_enabled / reason_codes to confirm the governed posture.", "properties": { "ok": { "type": "boolean", "enum": [ true ] }, "data": { "type": "object", "additionalProperties": true }, "status": { "type": "string" }, "reason_codes": { "type": "array", "items": { "$ref": "#/components/schemas/ReasonCode" } }, "next_allowed_actions": { "type": "array", "items": { "type": "string" } }, "authority_boundary": { "type": "string" }, "proof_ref": { "type": "string", "nullable": true }, "transition_log": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] }, "authority": { "$ref": "#/components/schemas/Authority" }, "limitations": { "type": "array", "items": { "type": "string" } } } }, "TriggerErrorEnvelope": { "type": "object", "required": [ "ok", "status", "error", "reason_codes", "next_allowed_actions", "authority_boundary", "transition_log", "no_capital_moved", "live_execution_enabled", "authority", "limitations" ], "properties": { "ok": { "type": "boolean", "enum": [ false ] }, "status": { "type": "string", "enum": [ "blocked" ] }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string" }, "message": { "type": "string" }, "detail": { "type": "string", "nullable": true } } }, "reason_codes": { "type": "array", "items": { "$ref": "#/components/schemas/ReasonCode" } }, "next_allowed_actions": { "type": "array", "items": { "type": "string" } }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] }, "authority_boundary": { "type": "string" }, "transition_log": { "type": "array", "items": { "type": "string" } }, "authority": { "$ref": "#/components/schemas/Authority" }, "limitations": { "type": "array", "items": { "type": "string" } } } }, "ActionIntentSummary": { "type": "object", "properties": { "action_intent_id": { "type": "string" }, "workspace_id": { "type": "string" }, "current_status": { "type": "string" }, "version": { "type": "integer" }, "mandate_id": { "type": "string", "nullable": true }, "signal_label": { "type": "string", "nullable": true }, "selected_route": { "type": "string", "nullable": true }, "approval_state": { "type": "string" }, "event_count": { "type": "integer" }, "proof_chain_complete": { "type": "boolean" }, "created_at": { "type": "string", "nullable": true }, "updated_at": { "type": "string", "nullable": true }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] } } }, "ActionSpineAuditRecord": { "type": "object", "properties": { "audit_id": { "type": "string" }, "workspace_id": { "type": "string" }, "principal_id": { "type": "string", "nullable": true }, "actor_type": { "type": "string" }, "actor_id": { "type": "string" }, "action_intent_id": { "type": "string", "nullable": true }, "mandate_id": { "type": "string", "nullable": true }, "event_type": { "type": "string" }, "object_type": { "type": "string" }, "object_id": { "type": "string" }, "object_version": { "type": "integer", "nullable": true }, "previous_status": { "type": "string", "nullable": true }, "next_status": { "type": "string", "nullable": true }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "request_id": { "type": "string", "nullable": true }, "provenance_hash": { "type": "string" }, "source": { "type": "string", "enum": [ "lifecycle_event", "audit_event" ] }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] }, "created_at": { "type": "string" } } }, "WhoAmI": { "type": "object", "properties": { "bound": { "type": "boolean" }, "workspace_id": { "type": "string" }, "actor_role": { "type": "string" }, "principal_id": { "type": "string" }, "auth_source": { "type": "string" } } }, "MandateRegistered": { "type": "object", "properties": { "mandate_id": { "type": "string" }, "version": { "type": "integer" }, "provenance_hash": { "type": "string" }, "created": { "type": "boolean" }, "reason": { "type": "string" } } }, "WithSignal": { "type": "object", "properties": { "signal": { "type": "object", "additionalProperties": true } } }, "WithDecisionPacket": { "type": "object", "properties": { "decision_packet": { "type": "object", "additionalProperties": true } } }, "WithDurable": { "type": "object", "description": "The step artifact plus the durable replay projection.", "properties": { "durable": { "type": "object", "additionalProperties": true } }, "additionalProperties": true }, "WithActionIntentSummary": { "type": "object", "properties": { "action_intent": { "$ref": "#/components/schemas/ActionIntentSummary" }, "impact_count": { "type": "integer" } } }, "WithReplay": { "type": "object", "properties": { "replay": { "type": "object", "additionalProperties": true } } }, "WithEvents": { "type": "object", "properties": { "action_intent_id": { "type": "string" }, "events": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "event_count": { "type": "integer" } } }, "WithImpactRecords": { "type": "object", "properties": { "action_intent_id": { "type": "string" }, "impact_records": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "impact_count": { "type": "integer" } } }, "ActionIntentListPage": { "type": "object", "properties": { "workspace_scoped": { "type": "boolean" }, "action_intents": { "type": "array", "items": { "$ref": "#/components/schemas/ActionIntentSummary" } }, "total": { "type": "integer" }, "limit": { "type": "integer" }, "offset": { "type": "integer" }, "next_cursor": { "type": "string", "nullable": true, "description": "Opaque cursor for the next page (pass back as cursor); null on the last page." }, "has_more": { "type": "boolean", "description": "True when more items exist after this page." } } }, "ImpactLedgerPage": { "type": "object", "properties": { "workspace_scoped": { "type": "boolean" }, "impact_ledger": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "total": { "type": "integer" }, "limit": { "type": "integer" }, "offset": { "type": "integer" }, "next_cursor": { "type": "string", "nullable": true, "description": "Opaque cursor for the next page, or null on the last page." }, "has_more": { "type": "boolean", "description": "True when more rows exist after this page." } } }, "AuditPage": { "type": "object", "properties": { "workspace_scoped": { "type": "boolean" }, "audit": { "type": "array", "items": { "$ref": "#/components/schemas/ActionSpineAuditRecord" } }, "total": { "type": "integer" }, "limit": { "type": "integer" }, "offset": { "type": "integer" }, "next_cursor": { "type": "string", "nullable": true, "description": "Opaque cursor for the next page (pass back as cursor); null on the last page." }, "has_more": { "type": "boolean", "description": "True when more items exist after this page." } } }, "SignalCreateRequest": { "type": "object", "required": [ "signal_type", "source", "label", "summary", "subject_ref", "observation" ], "properties": { "signal_type": { "type": "string" }, "source": { "type": "string" }, "label": { "type": "string" }, "summary": { "type": "string" }, "subject_ref": { "type": "string" }, "observation": { "type": "string" }, "asset_ref": { "type": "string" }, "evidence_class": { "type": "string" }, "confidence": { "type": "number" }, "evidence_refs": { "type": "array", "items": { "type": "string" } }, "now_iso": { "type": "string" } }, "additionalProperties": true }, "PacketCreateRequest": { "type": "object", "required": [ "signal", "thesis", "evidence_score", "counter_evidence_score", "scenario_score" ], "properties": { "signal": { "type": "object", "additionalProperties": true }, "thesis": { "type": "string" }, "evidence_score": { "type": "number" }, "counter_evidence_score": { "type": "number" }, "scenario_score": { "type": "number" } }, "additionalProperties": true }, "DurableCreateRequest": { "type": "object", "description": "Creating a durable ActionIntent ALSO requires a mandate reference: either a registered mandate_id + mandate_version (recommended; the surface may enforce a pre-registered mandate) OR an inline mandate object where the surface permits it. Omitting all three is refused with blocked_missing_mandate.", "required": [ "signal", "decision_packet", "runtime", "idempotency_key", "move" ], "properties": { "signal": { "type": "object", "additionalProperties": true }, "decision_packet": { "type": "object", "additionalProperties": true }, "mandate": { "type": "object", "additionalProperties": true, "description": "Inline CapitalMandate (accepted only where the surface allows inline mandates)." }, "mandate_id": { "type": "string", "description": "Id of a previously registered mandate. Pair with mandate_version." }, "mandate_version": { "type": "integer", "description": "Version of the registered mandate. Pair with mandate_id." }, "runtime": { "$ref": "#/components/schemas/RuntimeContextRequest" }, "move": { "type": "object", "additionalProperties": true }, "idempotency_key": { "type": "string" }, "now_iso": { "type": "string" } }, "additionalProperties": true }, "ActionIntentIdRequest": { "type": "object", "required": [ "action_intent_id" ], "properties": { "action_intent_id": { "type": "string" }, "now_iso": { "type": "string" } }, "additionalProperties": true }, "ApprovalRecordRequest": { "type": "object", "description": "Legacy record-approval body: the caller supplies the full ApprovalEvent, which is validated server-side. Prefer POST /approvals/{id}/decision.", "required": [ "action_intent_id", "approval_event" ], "properties": { "action_intent_id": { "type": "string" }, "approval_event": { "type": "object", "additionalProperties": true, "description": "The full ApprovalEvent (decision, role, actor, approved version, evidence hash) — validated server-side." }, "now_iso": { "type": "string" } }, "additionalProperties": true }, "RouterPrepareRequest": { "type": "object", "required": [ "action_intent_id" ], "properties": { "action_intent_id": { "type": "string" }, "adapter_kind": { "type": "string", "enum": [ "paper", "draft_handoff", "null_blocked" ] }, "now_iso": { "type": "string" } } }, "PaperOpenRequest": { "type": "object", "required": [ "action_intent_id" ], "properties": { "action_intent_id": { "type": "string" }, "expected_price": { "type": "number" }, "observed_price": { "type": "number" }, "fees_usd": { "type": "number" }, "slippage_bps": { "type": "number" }, "evidence_refs": { "type": "array", "items": { "type": "string" } }, "now_iso": { "type": "string" } } }, "ImpactRecordRequest": { "type": "object", "required": [ "action_intent_id" ], "properties": { "action_intent_id": { "type": "string" }, "estimated_usd": { "type": "number", "nullable": true }, "measured_usd": { "type": "number", "nullable": true }, "explanation": { "type": "string" }, "evidence_refs": { "type": "array", "items": { "type": "string" } }, "now_iso": { "type": "string" } } }, "DriftMonitorRequest": { "type": "object", "required": [ "action_intent_id" ], "properties": { "action_intent_id": { "type": "string" }, "trigger": { "type": "string" }, "severity": { "type": "string", "enum": [ "within", "watch", "review" ] }, "observed_at": { "type": "string" }, "evidence_refs": { "type": "array", "items": { "type": "string" } } } }, "MandateRegisterRequest": { "type": "object", "description": "The mandate MAY declare required_compliance_checks (an array of ComplianceCheckType values): intents under it then cannot pass preflight or prepare a route until every required check is recorded, passing, fresh, and not awaiting human review. Absent (every pre-existing mandate) = no compliance requirement; behavior unchanged.", "required": [ "mandate" ], "properties": { "mandate": { "type": "object", "additionalProperties": true }, "now_iso": { "type": "string" } } }, "ComplianceCheckType": { "type": "string", "enum": [ "suitability", "kyc", "aml", "sanctions", "risk_profile", "tax_review", "liquidity_review", "custom_policy" ], "description": "Closed set of compliance check types a mandate can require and an intent can carry." }, "ComplianceCheckStatus": { "type": "string", "enum": [ "pass", "fail", "needs_review", "expired", "unavailable" ], "description": "Closed status set. A recorded pass is ALSO stale-checked from expires_at against a SERVER clock at gating time. unavailable = the check could not be performed (honest) and gates as not-passing." }, "ActionIntentEvidenceMap": { "type": "object", "description": "Deterministic READ-ONLY projection of an ActionIntent's durable lifecycle into the auditor 'Proof Product' record. Records-only: no capital moved, nothing authorized. exceptions.clean is true ONLY when the lifecycle is fully satisfied end-to-end; exceptions.flags surfaces every state an auditor must review and distinguishes pending from adverse. Section objects (header/decision/mandate/preflight/approvals/impact and the array items) are open-shaped here; the typed SDK carries their full field set.", "required": [ "header", "decision", "mandate", "compliance_checks", "preflight", "approvals", "route_deliverables", "impact", "timeline", "exceptions", "authority_statement", "generated_note" ], "properties": { "header": { "type": "object", "additionalProperties": true, "description": "action_intent_id, current_status, version, intent_version, event_count, created_at, updated_at, proof_chain_complete, chain_valid, no_capital_moved:true, live_execution_enabled:false." }, "decision": { "type": "object", "additionalProperties": true, "description": "has_signal, has_decision_packet, and proposed_move {move_type, instrument, asset_class, proposed_notional_usd, requested_rail, rationale} | null." }, "mandate": { "type": "object", "additionalProperties": true, "description": "checked, mandate_id, mandate_version, verdict, allowed, blocked, reason_codes, missing_requirements, required_compliance_checks." }, "compliance_checks": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "preflight": { "type": "object", "additionalProperties": true, "description": "ran, status, reason_codes, missing_items, missing_approvals, risk_notes." }, "approvals": { "type": "object", "additionalProperties": true, "description": "requested, request_status, required_roles, and decisions[] {role, actor_ref, decision, approved_version, evidence_packet_hash, created_at}." }, "route_deliverables": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "impact": { "type": "object", "additionalProperties": true, "description": "recorded, category, evidence_class, estimated_usd, measured_usd, explanation, created_at, no_capital_moved:true." }, "timeline": { "type": "array", "items": { "type": "object", "additionalProperties": true }, "description": "Ordered lifecycle events, each with payload_hash and prev_hash proof refs." }, "exceptions": { "type": "object", "description": "Derived 'what an auditor must review' section. clean is true ONLY when flags is empty.", "required": [ "proof_chain_complete", "chain_valid", "missing_event_classes", "invalid_reasons", "flags", "clean" ], "properties": { "proof_chain_complete": { "type": "boolean" }, "chain_valid": { "type": "boolean" }, "missing_event_classes": { "type": "array", "items": { "type": "string" } }, "invalid_reasons": { "type": "array", "items": { "type": "string" } }, "flags": { "type": "array", "items": { "type": "string" }, "description": "Every failed/blocked/rejected/incomplete/unsatisfied state; empty iff clean." }, "clean": { "type": "boolean" } }, "additionalProperties": false }, "authority_statement": { "type": "string" }, "generated_note": { "type": "string" } }, "additionalProperties": false }, "EmbedSessionView": { "type": "object", "description": "Safe-to-return view of an embed-approval session — NO token, NO hash. active = revoked_at is null.", "required": [ "session_id", "workspace_id", "principal_id", "actor_role", "scope", "token_prefix", "last4", "issued_at", "expires_at", "revoked_at", "active" ], "properties": { "session_id": { "type": "string" }, "workspace_id": { "type": "string" }, "principal_id": { "type": "string" }, "actor_role": { "type": "string", "enum": [ "user", "advisor", "compliance", "operator" ] }, "scope": { "type": "string", "enum": [ "approval_inbox" ] }, "token_prefix": { "type": "string", "description": "Non-secret scannable prefix + last-4 (e.g. eas_…abcd)." }, "last4": { "type": "string" }, "issued_at": { "type": "string" }, "expires_at": { "type": "string" }, "revoked_at": { "type": [ "string", "null" ] }, "active": { "type": "boolean" } }, "additionalProperties": false }, "EmbedSessionIssueRequest": { "type": "object", "description": "Optional body. workspace / principal / role / scope are NEVER taken from the body — they come from the verified principal (scope is always approval_inbox).", "properties": { "ttl_seconds": { "type": [ "number", "null" ], "description": "Requested lifetime; clamped to the policy band [60, 3600] (default 900)." } }, "additionalProperties": true }, "EmbedSessionIssueResult": { "type": "object", "description": "The issued session view + the plaintext token, which is shown ONCE and never retrievable again.", "required": [ "embed_session", "token" ], "properties": { "embed_session": { "$ref": "#/components/schemas/EmbedSessionView" }, "token": { "type": "string", "description": "The eas_ bearer token — shown once; only a one-way hash is stored." } }, "additionalProperties": false }, "EmbedSessionListResult": { "type": "object", "required": [ "embed_sessions", "count" ], "properties": { "embed_sessions": { "type": "array", "items": { "$ref": "#/components/schemas/EmbedSessionView" } }, "count": { "type": "integer" } }, "additionalProperties": false }, "EmbedSessionRevokeResult": { "type": "object", "required": [ "revoked", "session_id" ], "properties": { "revoked": { "type": "boolean", "description": "True only if an active session in the caller's workspace was revoked." }, "session_id": { "type": "string" } }, "additionalProperties": false }, "ComplianceCheckRecord": { "type": "object", "description": "One recorded compliance check (append-only history; gating reads the LATEST record per check_type). An attributed claim: recorded_by is the verified principal; provider is a recorded source label, not a call target.", "properties": { "check_id": { "type": "string" }, "check_type": { "$ref": "#/components/schemas/ComplianceCheckType" }, "provider": { "type": "string" }, "status": { "$ref": "#/components/schemas/ComplianceCheckStatus" }, "evidence_refs": { "type": "array", "items": { "type": "string" } }, "expires_at": { "type": "string", "nullable": true }, "required_for_route": { "type": "boolean" }, "action_intent_id": { "type": "string" }, "mandate_id": { "type": "string" }, "recorded_by": { "type": "string" }, "notes": { "type": "string", "nullable": true }, "created_at": { "type": "string" }, "authority": { "$ref": "#/components/schemas/Authority" } } }, "ComplianceCheckRecordRequest": { "type": "object", "required": [ "action_intent_id", "check_type", "status", "provider", "evidence_refs" ], "properties": { "action_intent_id": { "type": "string" }, "check_type": { "$ref": "#/components/schemas/ComplianceCheckType" }, "status": { "$ref": "#/components/schemas/ComplianceCheckStatus" }, "provider": { "type": "string", "description": "Recorded source label (e.g. \"manual_compliance_review\"). SigmaX performs no provider call." }, "evidence_refs": { "type": "array", "items": { "type": "string" }, "minItems": 1, "description": "Required — a compliance claim without evidence references is refused." }, "expires_at": { "type": "string", "description": "Optional ISO freshness horizon; staleness is evaluated against a SERVER clock." }, "notes": { "type": "string" } }, "additionalProperties": true }, "ComplianceCheckRecorded": { "type": "object", "properties": { "compliance_check": { "$ref": "#/components/schemas/ComplianceCheckRecord" }, "required_for_route": { "type": "boolean" }, "durable": { "type": "object", "additionalProperties": true } } }, "ComplianceChecksPage": { "type": "object", "properties": { "action_intent_id": { "type": "string" }, "required_compliance_checks": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceCheckType" } }, "compliance_checks": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceCheckRecord" } }, "count": { "type": "integer" } } }, "RouteDeliverableType": { "type": "string", "enum": [ "advisor_task", "broker_handoff_draft" ], "description": "The two non-live deliverable kinds (a strict subset of the route enum)." }, "RouteDeliverable": { "type": "object", "description": "A DRAFT artifact summarizing the governed chain. Never transmitted, never submitted; no capital moved. route_type is server-derived from the persisted governed route.", "properties": { "deliverable_id": { "type": "string" }, "action_intent_id": { "type": "string" }, "route_id": { "type": "string" }, "route_type": { "$ref": "#/components/schemas/RouteDeliverableType" }, "workspace_id": { "type": "string" }, "mandate_id": { "type": "string" }, "action_intent_version": { "type": "integer" }, "created_by_principal": { "type": "string" }, "created_at": { "type": "string" }, "status": { "type": "string", "enum": [ "draft", "blocked", "superseded" ] }, "title": { "type": "string" }, "summary": { "type": "string" }, "required_next_steps": { "type": "array", "items": { "type": "string" } }, "draft": { "type": "object", "additionalProperties": true }, "authority_boundary": { "type": "string" }, "disposition_statement": { "type": "string" }, "proof_refs": { "type": "array", "items": { "type": "string" } }, "audit_ref": { "type": "string" }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] }, "authority": { "$ref": "#/components/schemas/Authority" } } }, "RouteDeliverableCreated": { "type": "object", "properties": { "route_deliverable": { "$ref": "#/components/schemas/RouteDeliverable" }, "superseded": { "type": "array", "items": { "type": "string" } }, "durable": { "type": "object", "additionalProperties": true } } }, "RouteDeliverablesPage": { "type": "object", "properties": { "action_intent_id": { "type": "string" }, "route_deliverables": { "type": "array", "items": { "$ref": "#/components/schemas/RouteDeliverable" } }, "count": { "type": "integer" } } }, "WithRouteDeliverable": { "type": "object", "properties": { "route_deliverable": { "$ref": "#/components/schemas/RouteDeliverable" } } }, "GatewayEnvelope": { "type": "object", "required": [ "ok", "data", "status", "reason_codes", "no_capital_moved", "live_execution_enabled" ], "description": "The Agent Action Gateway success envelope. Same governed posture as the Action Spine; reason_codes are plain agent capability/disposition strings.", "properties": { "ok": { "type": "boolean", "enum": [ true ] }, "data": { "type": "object", "additionalProperties": true }, "status": { "type": "string" }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "next_allowed_actions": { "type": "array", "items": { "type": "string" } }, "authority_boundary": { "type": "string" }, "proof_ref": { "type": "string", "nullable": true }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] }, "authority": { "$ref": "#/components/schemas/Authority" }, "limitations": { "type": "array", "items": { "type": "string" } } } }, "GatewayErrorEnvelope": { "type": "object", "required": [ "ok", "status", "error", "no_capital_moved", "live_execution_enabled" ], "properties": { "ok": { "type": "boolean", "enum": [ false ] }, "status": { "type": "string", "enum": [ "blocked" ] }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string" }, "message": { "type": "string" }, "detail": { "type": "string", "nullable": true } } }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "next_allowed_actions": { "type": "array", "items": { "type": "string" } }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] } } }, "AgentActionProposal": { "type": "object", "description": "An agent-originated proposed capital action. provider label + *_hash are attribution only; no capital moves.", "properties": { "proposal_id": { "type": "string" }, "workspace_id": { "type": "string" }, "agent_id": { "type": "string" }, "agent_name": { "type": "string", "nullable": true }, "agent_run_id": { "type": "string", "nullable": true }, "agent_provider_label": { "type": "string", "nullable": true }, "source_system": { "type": "string", "nullable": true }, "submitted_by_principal": { "type": "string" }, "proposed_capital_twin_id": { "type": "string", "nullable": true }, "mandate_id": { "type": "string", "nullable": true }, "mandate_version": { "type": "integer", "nullable": true }, "proposed_action_summary": { "type": "string" }, "proposed_action_type": { "type": "string" }, "proposed_asset_or_instrument": { "type": "string", "nullable": true }, "proposed_size_or_constraints": { "type": "string", "nullable": true }, "rationale": { "type": "string", "nullable": true }, "evidence_refs": { "type": "array", "items": { "type": "string" } }, "tool_call_refs": { "type": "array", "items": { "type": "string" } }, "prompt_hash": { "type": "string", "nullable": true, "pattern": "^(?:[a-z0-9][a-z0-9_-]*:)?[0-9a-fA-F]{32,128}$" }, "input_hash": { "type": "string", "nullable": true, "pattern": "^(?:[a-z0-9][a-z0-9_-]*:)?[0-9a-fA-F]{32,128}$" }, "output_hash": { "type": "string", "nullable": true, "pattern": "^(?:[a-z0-9][a-z0-9_-]*:)?[0-9a-fA-F]{32,128}$" }, "requested_next_step": { "type": "string" }, "mode": { "type": "string", "enum": [ "shadow_only", "paper_request", "human_review_required" ] }, "created_at": { "type": "string" }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] }, "authority": { "$ref": "#/components/schemas/Authority" } } }, "AgentProposalRequest": { "type": "object", "required": [ "agent_id", "proposed_action_summary", "proposed_action_type" ], "description": "Submit hashes/refs only — a raw prompt / credential field is refused. requested_next_step must be an ALLOWED agent capability (propose_signal | draft_action_intent | draft_decision_packet | request_preflight | request_compliance_check_status | request_human_review | simulate_shadow | paper_track_request | draft_route_deliverable_request); a forbidden/unknown value fails closed + is audited.", "properties": { "agent_id": { "type": "string" }, "agent_name": { "type": "string" }, "agent_run_id": { "type": "string" }, "agent_provider_label": { "type": "string" }, "source_system": { "type": "string" }, "proposed_capital_twin_id": { "type": "string" }, "mandate_id": { "type": "string" }, "mandate_version": { "type": "integer" }, "proposed_action_summary": { "type": "string" }, "proposed_action_type": { "type": "string" }, "proposed_asset_or_instrument": { "type": "string" }, "proposed_size_or_constraints": { "type": "string" }, "rationale": { "type": "string" }, "evidence_refs": { "type": "array", "items": { "type": "string" } }, "tool_call_refs": { "type": "array", "items": { "type": "string" } }, "prompt_hash": { "type": "string", "pattern": "^(?:[a-z0-9][a-z0-9_-]*:)?[0-9a-fA-F]{32,128}$", "description": "Content hash only (optionally algorithm-prefixed hex). A raw prompt / credential is refused; a non-hash-shaped value is refused too — a raw value cannot be smuggled through a *_hash field." }, "input_hash": { "type": "string", "pattern": "^(?:[a-z0-9][a-z0-9_-]*:)?[0-9a-fA-F]{32,128}$" }, "output_hash": { "type": "string", "pattern": "^(?:[a-z0-9][a-z0-9_-]*:)?[0-9a-fA-F]{32,128}$" }, "requested_next_step": { "type": "string" }, "mode": { "type": "string", "enum": [ "shadow_only", "paper_request", "human_review_required" ] } }, "additionalProperties": true }, "AgentProposalReceived": { "type": "object", "properties": { "proposal": { "$ref": "#/components/schemas/AgentActionProposal" }, "allowed_agent_capabilities": { "type": "array", "items": { "type": "string" } }, "blocked_agent_capabilities": { "type": "array", "items": { "type": "string" } } } }, "AgentActionEvaluation": { "type": "object", "description": "The governed evaluation. action_intent_id (when created) is a DRAFT requiring human authorization; the agent never approves.", "properties": { "evaluation_id": { "type": "string" }, "proposal_id": { "type": "string" }, "workspace_id": { "type": "string" }, "action_intent_id": { "type": "string", "nullable": true }, "mandate_verdict": { "type": "string", "nullable": true }, "preflight_verdict": { "type": "string", "nullable": true }, "compliance_verdict": { "type": "string", "nullable": true }, "allowed_agent_capabilities": { "type": "array", "items": { "type": "string" } }, "blocked_agent_capabilities": { "type": "array", "items": { "type": "string" } }, "required_human_action": { "type": "string" }, "next_allowed_steps": { "type": "array", "items": { "type": "string" } }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "audit_ref": { "type": "string" }, "created_at": { "type": "string" }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] }, "authority": { "$ref": "#/components/schemas/Authority" } } }, "AgentProposalView": { "type": "object", "properties": { "proposal": { "$ref": "#/components/schemas/AgentActionProposal" }, "evaluations": { "type": "array", "items": { "$ref": "#/components/schemas/AgentActionEvaluation" } } } }, "AgentEvaluationResult": { "type": "object", "properties": { "evaluation": { "$ref": "#/components/schemas/AgentActionEvaluation" } } }, "AgentAuditPage": { "type": "object", "properties": { "proposal_id": { "type": "string" }, "audit": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "count": { "type": "integer" } } }, "ApprovalDecisionRequest": { "type": "object", "required": [ "decision", "risk_acknowledgements" ], "properties": { "decision": { "type": "string", "enum": [ "approved", "rejected", "needs_changes" ] }, "risk_acknowledgements": { "type": "array", "items": { "type": "string" }, "minItems": 1 }, "now_iso": { "type": "string" } } }, "RuntimeContextRequest": { "type": "object", "description": "The authenticated caller’s runtime claim, persisted at creation (anti-forgery: preflight later recomputes against the PERSISTED runtime, never a fresh caller-supplied one). The three booleans + the stop-condition array are HARD-REQUIRED by the server; numeric fields are optional honest measurements (null/omitted = not measured).", "required": [ "active_stop_conditions", "liquidity_reserve_ok", "market_hours_ok", "venue_available" ], "properties": { "active_stop_conditions": { "type": "array", "items": { "type": "string" } }, "liquidity_reserve_ok": { "type": "boolean" }, "market_hours_ok": { "type": "boolean" }, "venue_available": { "type": "boolean" }, "current_single_asset_pct": { "type": "number", "nullable": true }, "projected_single_asset_pct": { "type": "number", "nullable": true }, "current_crypto_notional_usd": { "type": "number", "nullable": true }, "projected_crypto_notional_usd": { "type": "number", "nullable": true }, "cash_after_action_usd": { "type": "number", "nullable": true }, "estimated_slippage_bps": { "type": "number", "nullable": true }, "max_slippage_bps": { "type": "number", "nullable": true } }, "additionalProperties": true }, "RouteFeasibilityProducerRunRequest": { "type": "object", "description": "Route-feasibility producer run request against an EXISTING ActionIntent. requested_rail is a caller-supplied label (echoed into evidence; not enum-validated). The numeric fields are caller-supplied friction estimates — each is optional and nullable; a missing or non-number value leaves that dimension unassessed (deny-by-default, never a silent pass). Timestamps are SERVER-stamped.", "required": [ "action_intent_id", "requested_rail" ], "properties": { "action_intent_id": { "type": "string" }, "requested_rail": { "type": "string" }, "proposed_notional_usd": { "type": [ "number", "null" ] }, "estimated_cost_bps": { "type": [ "number", "null" ] }, "max_acceptable_cost_bps": { "type": [ "number", "null" ] }, "quote_age_seconds": { "type": [ "number", "null" ] }, "max_quote_age_seconds": { "type": [ "number", "null" ] }, "estimated_route_capacity_usd": { "type": [ "number", "null" ] }, "friction_review_cost_ratio": { "type": [ "number", "null" ], "description": "Optional override (clamped to [0,1]); default 0.5. Cost at/above ratio*ceiling (but not over it) is friction_review." } }, "additionalProperties": true }, "RouteFeasibilityCompliancePlan": { "type": "object", "description": "The deterministic route-friction plan (pure; reads no clock or principal, prices no venue). check_type is always custom_policy; provider is a recorded label (sigmax_route_feasibility_policy), never a call target. status maps feasible->pass, friction_review->needs_review, infeasible->fail, unknown->unavailable. deny_codes is the collect-all set of tripped friction conditions.", "required": [ "check_type", "provider", "status", "evidence_refs", "notes", "finality", "deny_codes" ], "properties": { "check_type": { "type": "string", "enum": [ "custom_policy" ] }, "provider": { "type": "string" }, "status": { "$ref": "#/components/schemas/ComplianceCheckStatus" }, "evidence_refs": { "type": "array", "items": { "type": "string" } }, "notes": { "type": "string" }, "finality": { "type": "string", "enum": [ "feasible", "friction_review", "infeasible", "unknown" ] }, "deny_codes": { "type": "array", "items": { "type": "string", "enum": [ "cost_over_ceiling", "size_over_capacity", "quote_stale", "cost_near_ceiling", "inputs_incomplete" ] } } } }, "RouteFeasibilityProducerRunResult": { "description": "A discriminated union on `mode`: the two branches carry structurally DISJOINT fields. mode=dry_run -> { plan, produced:null } and NOTHING persists (default until the ARMED flag is on). mode=persisted -> a single custom_policy ComplianceCheck was appended (compliance_check + required_for_route + durable replay). Recording never transitions the lifecycle; the route gate recomputes server-side at preflight. Each branch is closed (additionalProperties:false) so a generated client cannot conflate the two shapes.", "oneOf": [ { "$ref": "#/components/schemas/RouteFeasibilityProducerDryRunResult" }, { "$ref": "#/components/schemas/RouteFeasibilityProducerPersistedResult" } ], "discriminator": { "propertyName": "mode", "mapping": { "dry_run": "#/components/schemas/RouteFeasibilityProducerDryRunResult", "persisted": "#/components/schemas/RouteFeasibilityProducerPersistedResult" } } }, "RouteFeasibilityProducerDryRunResult": { "type": "object", "description": "Default (producer NOT armed): the planned custom_policy check is returned for human review and NOTHING persists.", "required": [ "mode", "plan", "produced" ], "properties": { "mode": { "type": "string", "enum": [ "dry_run" ] }, "plan": { "$ref": "#/components/schemas/RouteFeasibilityCompliancePlan" }, "produced": { "type": "null", "description": "Always null in dry-run — nothing was produced/persisted." } }, "additionalProperties": false }, "RouteFeasibilityProducerPersistedResult": { "type": "object", "description": "Producer ARMED: exactly one custom_policy ComplianceCheck was appended. Recording never transitions the lifecycle — the durable projection status is unchanged; the route gate recomputes at preflight.", "required": [ "mode", "compliance_check", "required_for_route", "durable" ], "properties": { "mode": { "type": "string", "enum": [ "persisted" ] }, "compliance_check": { "$ref": "#/components/schemas/ComplianceCheckRecord" }, "required_for_route": { "type": "boolean" }, "durable": { "type": "object", "additionalProperties": true } }, "additionalProperties": false }, "InstrumentAccessProducerRunRequest": { "type": "object", "description": "Instrument-access producer run request against an EXISTING ActionIntent. venue_id / instrument_family are NOT validated against a closed enum — an unknown combination is denied-by-default by the policy engine (recorded status \"unavailable\", never \"pass\"). Only requested_mode is enum-validated. Timestamps are SERVER-stamped.", "required": [ "action_intent_id", "venue_id", "instrument_family", "requested_mode" ], "properties": { "action_intent_id": { "type": "string" }, "venue_id": { "type": "string" }, "instrument_family": { "type": "string" }, "requested_mode": { "type": "string", "enum": [ "observe", "shadow", "paper", "canary", "live" ] } }, "additionalProperties": true }, "InstrumentAccessCompliancePlan": { "type": "object", "description": "The deterministic instrument-access policy plan (pure; reads no clock or principal). check_type is always custom_policy; provider is a recorded label (sigmax_instrument_access_policy), never a call target. status maps allow->pass, venue_requires_review->needs_review, venue_blocked/mode_not_allowed->fail, unregistered->unavailable.", "required": [ "check_type", "provider", "status", "evidence_refs", "notes", "finality", "deny_code" ], "properties": { "check_type": { "type": "string", "enum": [ "custom_policy" ] }, "provider": { "type": "string" }, "status": { "$ref": "#/components/schemas/ComplianceCheckStatus" }, "evidence_refs": { "type": "array", "items": { "type": "string" } }, "notes": { "type": "string" }, "finality": { "type": "string", "enum": [ "allow", "deny" ] }, "deny_code": { "type": [ "string", "null" ] } } }, "InstrumentAccessProducerRunResult": { "description": "A discriminated union on `mode`: the two branches carry structurally DISJOINT fields. mode=dry_run -> { plan, produced:null } and NOTHING persists (default until the ARMED flag is on). mode=persisted -> a single custom_policy ComplianceCheck was appended (compliance_check + required_for_route + durable replay). Recording never transitions the lifecycle; the route gate recomputes server-side at preflight. Each branch is closed (additionalProperties:false) so a generated client cannot conflate the two shapes (e.g. a compliance_check in a dry_run response is invalid).", "oneOf": [ { "$ref": "#/components/schemas/InstrumentAccessProducerDryRunResult" }, { "$ref": "#/components/schemas/InstrumentAccessProducerPersistedResult" } ], "discriminator": { "propertyName": "mode", "mapping": { "dry_run": "#/components/schemas/InstrumentAccessProducerDryRunResult", "persisted": "#/components/schemas/InstrumentAccessProducerPersistedResult" } } }, "InstrumentAccessProducerDryRunResult": { "type": "object", "description": "Default (producer NOT armed): the planned custom_policy check is returned for human review and NOTHING persists.", "required": [ "mode", "plan", "produced" ], "properties": { "mode": { "type": "string", "enum": [ "dry_run" ] }, "plan": { "$ref": "#/components/schemas/InstrumentAccessCompliancePlan" }, "produced": { "type": "null", "description": "Always null in dry-run — nothing was produced/persisted." } }, "additionalProperties": false }, "InstrumentAccessProducerPersistedResult": { "type": "object", "description": "Producer ARMED: exactly one custom_policy ComplianceCheck was appended. Recording never transitions the lifecycle — the durable projection status is unchanged; the route gate recomputes at preflight.", "required": [ "mode", "compliance_check", "required_for_route", "durable" ], "properties": { "mode": { "type": "string", "enum": [ "persisted" ] }, "compliance_check": { "$ref": "#/components/schemas/ComplianceCheckRecord" }, "required_for_route": { "type": "boolean" }, "durable": { "type": "object", "additionalProperties": true } }, "additionalProperties": false }, "FiduciaryDriftProducerRunRequest": { "type": "object", "description": "Producer run request. The mandate MUST be registered (mandate_id + mandate_version; inline mandates are never accepted). Timestamps are SERVER-stamped — a body now_iso is ignored on this route.", "required": [ "mandate_id", "mandate_version", "runtime" ], "properties": { "mandate_id": { "type": "string" }, "mandate_version": { "type": "integer" }, "runtime": { "$ref": "#/components/schemas/RuntimeContextRequest" } }, "additionalProperties": true }, "FiduciaryDriftProducerProducedItem": { "type": "object", "description": "One per planned candidate on an ARMED run. outcome=created (new lifecycle), idempotent_replay (unchanged evidence re-scan), or failed (the store refused — e.g. blocked_idempotency_payload_mismatch when the same evidence identity arrives with conflicting content; nothing partial is written).", "required": [ "envelope_id", "outcome" ], "properties": { "envelope_id": { "type": "string" }, "entity_id": { "type": "string" }, "breach_class": { "type": "string" }, "severity": { "type": "string" }, "drift_event_id": { "type": "string" }, "intent_id": { "type": "string" }, "status": { "type": "string" }, "outcome": { "type": "string", "enum": [ "created", "idempotent_replay", "failed" ] }, "error": { "type": "string", "nullable": true }, "reason_codes": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": true }, "ThesisProducerRunRequest": { "type": "object", "description": "Producer run request. The mandate MUST be registered (mandate_id + mandate_version; inline mandates are never accepted). Timestamps are SERVER-stamped — a body now_iso is ignored on this route.", "required": [ "mandate_id", "mandate_version", "runtime" ], "properties": { "mandate_id": { "type": "string" }, "mandate_version": { "type": "integer" }, "runtime": { "$ref": "#/components/schemas/RuntimeContextRequest" } }, "additionalProperties": true }, "ThesisProducerProducedItem": { "type": "object", "description": "One per planned candidate on an ARMED run. outcome=created (new lifecycle), idempotent_replay (unchanged thesis re-scan), or failed (the store refused — e.g. blocked_idempotency_payload_mismatch when the same thesis identity arrives with conflicting content; nothing partial is written).", "required": [ "thesis_id", "outcome" ], "properties": { "thesis_id": { "type": "string" }, "title": { "type": "string" }, "thesis_status": { "type": "string" }, "intent_id": { "type": "string" }, "status": { "type": "string" }, "outcome": { "type": "string", "enum": [ "created", "idempotent_replay", "failed" ] }, "error": { "type": "string", "nullable": true }, "reason_codes": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": true }, "WebhookEnvelope": { "type": "object", "required": [ "ok", "data", "status", "reason_codes", "no_capital_moved", "live_execution_enabled" ], "description": "The webhook success envelope — the governed no-capital/no-live posture, LEANER than the trigger-engine envelope (no next_allowed_actions / proof_ref / transition_log).", "properties": { "ok": { "type": "boolean", "enum": [ true ] }, "data": { "type": "object", "additionalProperties": true }, "status": { "type": "string" }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "authority_boundary": { "type": "string" }, "limitations": { "type": "array", "items": { "type": "string" } }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] }, "authority": { "$ref": "#/components/schemas/Authority" } } }, "WebhookErrorEnvelope": { "type": "object", "required": [ "ok", "status", "error", "no_capital_moved", "live_execution_enabled" ], "properties": { "ok": { "type": "boolean", "enum": [ false ] }, "status": { "type": "string", "enum": [ "blocked" ] }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string" }, "message": { "type": "string" }, "detail": { "type": "string", "nullable": true } } }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "no_capital_moved": { "type": "boolean", "enum": [ true ] }, "live_execution_enabled": { "type": "boolean", "enum": [ false ] } } }, "WebhookEventType": { "type": "string", "enum": [ "action_intent.created", "preflight.completed", "compliance_check.recorded", "approval.requested", "approval.recorded", "route_deliverable.created", "impact.recorded", "audit.recorded", "agent_proposal.received", "agent_proposal.evaluated", "agent_forbidden_capability.blocked" ], "description": "The closed webhook event catalog." }, "WebhookSubscription": { "type": "object", "description": "A subscription as returned by list/pause/delete. The HMAC signing secret is never included (only secret_prefix).", "properties": { "subscription_id": { "type": "string" }, "workspace_id": { "type": "string" }, "endpoint_url": { "type": "string", "format": "uri" }, "event_types": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookEventType" } }, "secret_prefix": { "type": "string" }, "status": { "type": "string", "enum": [ "active", "paused", "revoked" ] }, "created_by_principal": { "type": "string" }, "created_at": { "type": "string" }, "updated_at": { "type": "string" } } }, "WebhookDelivery": { "type": "object", "description": "A delivery record. Carries only payload_hash (never the event payload body).", "properties": { "delivery_id": { "type": "string" }, "subscription_id": { "type": "string" }, "workspace_id": { "type": "string" }, "event_type": { "$ref": "#/components/schemas/WebhookEventType" }, "event_id": { "type": "string" }, "action_intent_id": { "type": "string", "nullable": true, "description": "The ActionIntent this event belongs to; dereference via GET /action-intents/{id}. Null for agent-gateway events; absent on deliveries enqueued before this field existed." }, "payload_hash": { "type": "string" }, "status": { "type": "string", "enum": [ "pending", "delivered", "failed", "retrying", "dead_lettered" ] }, "attempts": { "type": "integer" }, "next_attempt_at": { "type": "string", "nullable": true }, "last_error": { "type": "string", "nullable": true }, "created_at": { "type": "string" }, "updated_at": { "type": "string" } } }, "WebhookSubscriptionRequest": { "type": "object", "required": [ "endpoint_url", "event_types" ], "properties": { "endpoint_url": { "type": "string", "format": "uri", "description": "HTTPS endpoint. SSRF-validated: non-HTTPS, credentials-in-URL, and private/loopback/link-local/CGNAT/metadata targets (incl. hostnames that resolve to them) are refused." }, "event_types": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookEventType" }, "minItems": 1 } }, "additionalProperties": true }, "WebhookSubscriptionCreated": { "type": "object", "properties": { "subscription": { "$ref": "#/components/schemas/WebhookSubscription" }, "secret_plaintext_once": { "type": "string", "description": "The HMAC signing secret, shown ONCE at creation and never returned again. Store it now." }, "delivery_enabled": { "type": "boolean" }, "delivery_flag": { "type": "string" } } }, "WebhookSubscriptionOne": { "type": "object", "properties": { "subscription": { "$ref": "#/components/schemas/WebhookSubscription" } } }, "WebhookSubscriptionList": { "type": "object", "properties": { "subscriptions": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookSubscription" } }, "delivery_enabled": { "type": "boolean" }, "delivery_flag": { "type": "string" } } }, "WebhookDeliveryList": { "type": "object", "properties": { "deliveries": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookDelivery" } }, "delivery_enabled": { "type": "boolean" }, "delivery_flag": { "type": "string" } } }, "WebhookDeliveryReplayed": { "type": "object", "properties": { "delivery": { "$ref": "#/components/schemas/WebhookDelivery" }, "replay_queued": { "type": "boolean" }, "sent_now": { "type": "boolean" }, "worker_status": { "type": "string" }, "delivery_enabled": { "type": "boolean" }, "delivery_flag": { "type": "string" } } }, "FiduciaryDriftProducerRunResult": { "type": "object", "description": "The producer plan. mode=dry_run -> nothing persisted (default until the ARMED flag is on); mode=persisted -> each candidate went through the same atomic lifecycle create the durable create route uses, with a PER-CANDIDATE outcome (created | idempotent_replay | failed — a persisted run can contain failed rows; inspect produced[].outcome, not only mode). Candidates stop at a human-required status; skipped rows carry an honest reason (in_envelope | data_blocked | not_approval_gated | workspace_mismatch | sample_labeled). The envelope-level reason_codes carry approval_required whenever ANY candidate exists (every candidate is human-stop by construction).", "required": [ "mode", "envelope_source_wired", "candidates", "skipped", "counts", "produced" ], "properties": { "mode": { "type": "string", "enum": [ "dry_run", "persisted" ] }, "envelope_source_wired": { "type": "boolean", "description": "False -> no envelope read-model is wired; an empty result then means \"no data source\", not \"no breaches\"." }, "candidates": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "skipped": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "counts": { "type": "object", "properties": { "envelopes": { "type": "integer" }, "candidates": { "type": "integer" }, "skipped": { "type": "integer" } } }, "produced": { "type": "array", "items": { "$ref": "#/components/schemas/FiduciaryDriftProducerProducedItem" } } } }, "ThesisProducerRunResult": { "type": "object", "description": "The producer plan. mode=dry_run -> nothing persisted (default until the ARMED flag is on); mode=persisted -> each candidate went through the same atomic lifecycle create the durable create route uses, with a PER-CANDIDATE outcome (created | idempotent_replay | failed — inspect produced[].outcome, not only mode). Candidates stop at a human-required status; skipped rows carry an honest reason (not_confirmed | oos_gate_not_passed | sample_labeled | workspace_mismatch | not_approval_gated). A thesis is a VIEW, not a position: every produced move is UNSIZED (null notional) and non-capital-linked. The envelope-level reason_codes carry approval_required whenever ANY candidate exists (every candidate is human-stop by construction).", "required": [ "mode", "thesis_source_wired", "candidates", "skipped", "counts", "produced" ], "properties": { "mode": { "type": "string", "enum": [ "dry_run", "persisted" ] }, "thesis_source_wired": { "type": "boolean", "description": "False -> no thesis store is wired; an empty result then means \"no data source\", not \"no confirmed theses\"." }, "candidates": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "skipped": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "counts": { "type": "object", "properties": { "theses": { "type": "integer" }, "candidates": { "type": "integer" }, "skipped": { "type": "integer" } } }, "produced": { "type": "array", "items": { "$ref": "#/components/schemas/ThesisProducerProducedItem" } } } }, "AuditTamperFinding": { "type": "object", "description": "A lifecycle audit row whose recomputed provenance hash does not match the stored hash. Hashes only — the raw payload is never surfaced.", "required": [ "audit_id", "event_id", "action_intent_id", "object_version", "expected_provenance_hash", "actual_provenance_hash" ], "properties": { "audit_id": { "type": "string" }, "event_id": { "type": "string" }, "action_intent_id": { "type": "string" }, "object_version": { "type": "integer" }, "expected_provenance_hash": { "type": "string" }, "actual_provenance_hash": { "type": "string" } } }, "AuditCompletenessFinding": { "type": "object", "description": "A per-intent object_version sequence anomaly — a missing or duplicated lifecycle event in the served stream.", "required": [ "action_intent_id", "kind", "present_versions" ], "properties": { "action_intent_id": { "type": "string" }, "kind": { "type": "string", "enum": [ "version_gap", "version_duplicate", "version_not_based_at_one" ] }, "present_versions": { "type": "array", "items": { "type": "integer" } } } }, "AuditVerification": { "type": "object", "description": "Recompute-on-read verification of the workspace audit stream. verified is true only when every recomputable lifecycle row's provenance recomputes AND per-intent completeness holds; not_recomputable audit_event rows are honestly excluded, never counted as verified. Detects an interior version gap or a missing head, but NOT a truncated tail (the highest object_version(s) removed) — there is no persisted per-intent upper bound to compare against; the database append-only trigger is the primary defense against tail deletion. Compare an independent expected count against total_lifecycle_events to spot a shortfall.", "required": [ "workspace_scoped", "checked_at", "verified", "total_lifecycle_events", "recomputed_ok", "not_recomputable_audit_events", "tamper_findings", "completeness_ok", "completeness_findings" ], "properties": { "workspace_scoped": { "type": "boolean" }, "checked_at": { "type": "string", "format": "date-time" }, "verified": { "type": "boolean" }, "total_lifecycle_events": { "type": "integer" }, "recomputed_ok": { "type": "integer" }, "not_recomputable_audit_events": { "type": "integer" }, "tamper_findings": { "type": "array", "items": { "$ref": "#/components/schemas/AuditTamperFinding" } }, "completeness_ok": { "type": "boolean" }, "completeness_findings": { "type": "array", "items": { "$ref": "#/components/schemas/AuditCompletenessFinding" } } } }, "ImpactIntegrityFinding": { "type": "object", "description": "A single Impact Ledger integrity finding. Value-free: identifiers plus a field name or count only — never a money value or free-text field content.", "required": [ "impact_record_id", "action_intent_id", "kind", "detail" ], "properties": { "impact_record_id": { "type": "string" }, "action_intent_id": { "type": "string" }, "kind": { "type": "string", "enum": [ "capital_moved_flag", "live_execution_flag", "missing_evidence_class", "non_finite_amount", "intent_id_mismatch", "duplicate_impact_record_id", "orphan_action_intent" ] }, "detail": { "type": "string", "description": "A field name (e.g. \"measured_usd\"), a count (e.g. \"count=2\"), or empty. Never a money value or free text." } } }, "ImpactLedgerVerification": { "type": "object", "description": "Integrity verification of the workspace Impact Ledger. Unlike /audit/verify this is not a recompute-vs-stored-hash proof (an ImpactRecord carries no provenance hash); it checks the governed invariants the ledger must always hold — capital-safety labels, evidence-class labeling, finite amounts, intent-ref consistency, duplicate content-hash ids, and orphan records. verified is true only when zero findings exist. Not a net-performance re-derivation and not a temporal-order proof.", "required": [ "workspace_scoped", "checked_at", "verified", "total_impact_records", "distinct_action_intents", "checked_ok", "capital_safety_violations", "duplicate_record_ids", "orphan_records", "findings" ], "properties": { "workspace_scoped": { "type": "boolean" }, "checked_at": { "type": "string", "format": "date-time" }, "verified": { "type": "boolean" }, "total_impact_records": { "type": "integer" }, "distinct_action_intents": { "type": "integer" }, "checked_ok": { "type": "integer" }, "capital_safety_violations": { "type": "integer" }, "duplicate_record_ids": { "type": "integer" }, "orphan_records": { "type": "integer" }, "findings": { "type": "array", "items": { "$ref": "#/components/schemas/ImpactIntegrityFinding" } } } } } } }