{ "schemaVersion": "eve-sota-metis-transport-decision.v1", "initiative": "eve-sota-gap-closure-2026-09-01", "taskId": "1.2", "recordedOn": "2026-09-01", "sourceEvidence": { "authoritative": [ { "path": "apps/metis/api-gateway/src/app.ts", "sha256": "41dfc18d3a4bb49e2ef7fb8f406fcbdea0478e8c0d4690131dbfb9baca9d93b5", "bytes": 23763 }, { "path": "apps/metis/api-gateway/src/config.ts", "sha256": "be9f7c1814c5673a9dd9e615f1b84ce0b096ba2a76baec6c1aa3fd8eee25a364", "bytes": 10074 }, { "path": "apps/metis/service/openapi/metis.openapi.json", "sha256": "c89749f7cadb7adea01931dcd39bc0b11a36c94fbf3a03fc8eec6e92544642af", "bytes": 7636101 }, { "path": "apps/metis/service/src/metis/api/__init__.py", "sha256": "9aa8bd2412098fb2e2404a146b5235b651149d7416239d8fff3f07f0752be79b", "bytes": 21043 }, { "path": "apps/metis/service/src/metis/deps.py", "sha256": "e157e9a76fa8fef1e302da8cb663ebb420b3e7f5dd426551118e9cfeddb215a6", "bytes": 15214 }, { "path": "apps/metis/service/src/metis/main.py", "sha256": "d58e087f98e5f5523f90ed4c848a4ed35bebffd5fc5131a41b4f16dd7e4591d6", "bytes": 14515 }, { "path": "apps/metis/web/src/app/api/metis/[...path]/route.ts", "sha256": "3c4b569eb4108a6df760d5cd0504e99c51faf1629e7b243239b3ef56e73058e2", "bytes": 1206 }, { "path": "apps/metis/web/src/hooks/useApi.ts", "sha256": "9432cd26a808af0f74cd7fd84c8a7573a00adb3601df559c6e6d92fbe0c76031", "bytes": 5498 }, { "path": "apps/metis/web/src/lib/server/endpoints.ts", "sha256": "6d471365580fd49bcc1b91f18564d938b76520ee0260a4bf65b3814c217a0e34", "bytes": 1205 }, { "path": "apps/metis/web/src/lib/server/metis-proxy.ts", "sha256": "266f9e8e0167441681cf6ee5d7a05837d9627a5429f48823af82d510eecfb4fa", "bytes": 1747 }, { "path": "apps/oshun/bff/src/adapters/domain-service-adapters.ts", "sha256": "565b29a2c810ffcb3e3507f239b11ff841b32eeb1ef4809af7b9cdd01751e91f", "bytes": 78546 }, { "path": "apps/oshun/bff/src/app.ts", "sha256": "6fde7b0fc542fd6f77004f5413b9007b067f5347b962f0fb611ef88a8d515c61", "bytes": 113161 }, { "path": "apps/oshun/bff/src/config/domain-service-discovery.ts", "sha256": "1848b099b822f5d2a9dd657cdf3ca7d30e22b22ece3390fad8211e5d2a81da70", "bytes": 7249 }, { "path": "apps/oshun/bff/src/health/domain-service-health.ts", "sha256": "1dea53f739902ded5003195804f7c721d6719e78af97155ac4e8edea7d60dfbe", "bytes": 13972 }, { "path": "apps/oshun/bff/src/metis/in-process-adapter.ts", "sha256": "1d5d81b620397ea95f25c0cc24d84bfcafcf7d04a23d7baff08073643ddb7307", "bytes": 11859 }, { "path": "docs/adr/ADR-0005-api-contract-approach.md", "sha256": "486353a40018d151f7d5f207231aa682869f6b086fffaec3b59cc2ddadd42dd3", "bytes": 23258 }, { "path": "docs/adr/ADR-M0.5-metis-persistence-ownership.md", "sha256": "8aada7b6f633388c77aae2b9cd4b27816b6f0e107c6a56020e2075e445d4eeb3", "bytes": 30540 }, { "path": "docs/agents/eve-workbench-kit-read-threat-model.md", "sha256": "fb2e9cd79f02476d1a257cdc6d93087ab1f861c23cdbfed8e5f71e9ccab13278", "bytes": 30996 }, { "path": "docs/audits/eve-sota-metis-seam-survey/2026-09-01.json", "sha256": "6bba3c4bc31eb9d580346f66174c5f0e7ddecdb430251398c057a45b991addb1", "bytes": 204340 }, { "path": "libs/shared/bff-kit/src/authz.ts", "sha256": "91d2b0ceea1f5b4b690f889fa86927aa8e4553211304fc73f0c44952e7f17296", "bytes": 16860 } ], "decisionImplementation": [ { "path": "docs/audits/eve-sota-metis-transport-decision.schema.json", "sha256": "dae4a6eaf1dbca86bda1cb848c1cc9b982e015efcd750c556146f4e7e52934d8", "bytes": 12247 }, { "path": "tools/eve-everywhere/generate-metis-transport-decision.mjs", "sha256": "657cdf01fe1732873e40870b577a19c478104610ce0cce10ba344594ff014006", "bytes": 24202 }, { "path": "tools/eve-everywhere/verify-metis-transport-decision.mjs", "sha256": "7b286f5855f2221a125cad96df722f25d9571ef95c2e8e560ffa7f94bc9484e5", "bytes": 9746 }, { "path": "tools/eve-everywhere/verify-metis-transport-decision.test.mjs", "sha256": "3f4fffcfc696acbd5e6538b43c7ee8d366789b37dc00a17edc806b1efb059345", "bytes": 9296 } ] }, "observedBaseline": { "fastApi": { "artifact": "apps/metis/service/openapi/metis.openapi.json", "sha256": "c89749f7cadb7adea01931dcd39bc0b11a36c94fbf3a03fc8eec6e92544642af", "openApiVersion": "3.1.0", "serviceVersion": "0.1.0", "pathCount": 803, "operationCount": 870, "schemaCount": 3665, "bearerOperationCount": 838, "unsecuredOperationCount": 32, "declaredPathPrefix": "/api", "selectedFacadePresent": false }, "browserTransport": { "publicPrefix": "/api/metis/v1", "nextProxyUpstreamPrefix": "/api", "defaultUpstreamOrigin": "http://localhost:4020" }, "nodeGateway": { "publicPrefix": "/api/v1", "registeredBaseRouteCount": 11, "hasCatchAllProxy": false }, "oshunBff": { "currentDefaultMetisAdapter": "in-process", "httpAdapterDevelopmentOrigin": "http://localhost:4601", "httpAdapterMetisPathPrefix": "/v1/metis", "normalReadTimeoutBounded": false, "normalReadRetriesBounded": false, "defaultServiceCredentialHeader": "x-oshun-service-token" }, "identityMismatch": { "oshunAccessTokenIssuer": "oshun-auth", "oshunAccessTokenAudience": "oshun-bff", "oshunClaims": ["scopes", "sub", "tid"], "metisChecksIssuer": false, "metisChecksAudience": false, "metisClaims": ["email", "name", "role", "sub"], "metisTenantClaim": null, "metisScopeClaim": null } }, "decision": { "status": "agent-adopted-pending-named-ratification", "selectedOption": "direct-versioned-metis-fastapi-http", "implementationAuthorized": true, "productionActivationAuthorized": false, "transport": { "caller": "oshun-bff-workbench-kit-read", "callee": "metis-fastapi-service", "baseUrlEnvironmentVariable": "OSHUN_METIS_API_BASE_URL", "routePrefix": "/api/v1/eve/workbench-read", "allowedMethod": "GET", "browserProxyAllowed": false, "nodeGatewayAllowed": false, "directStoreAllowed": false, "inProcessAdapterAllowedForEve": false, "httpsRequiredOutsideDevelopmentAndTest": true, "residencyRoutedOriginsRequired": true }, "versioning": { "contractId": "eve.metis.workbench-read.v1", "uriMajorVersion": "v1", "responseVersionHeader": "x-metis-contract-version", "initialSemanticVersion": "1.0.0", "openApiSliceRequired": true, "openApiSliceDigestRequiredAtBothEnds": true, "additiveChangeRule": "minor-version-bump-and-consumer-contract-pass", "breakingChangeRule": "new-uri-major-with-overlap-window", "unversionedApiFallbackAllowed": false }, "timeouts": { "perAttemptMs": 1000, "totalOperationMs": 2250, "retryBackoffBudgetMs": 250, "maxResponseBytes": 524288, "abortSignalRequired": true, "routeSpecificOverridesAllowed": false }, "retries": { "maxRetries": 1, "idempotentMethods": ["GET"], "retryableStatusCodes": [429, 502, 503, 504], "retryNetworkErrors": true, "retryTimeouts": true, "fixedDelayMs": 250, "retryAfterMaximumMs": 250, "retryAuthenticationFailures": false, "retryAuthorizationFailures": false, "retryContractViolations": false }, "circuitBreaker": { "consecutiveFailureThreshold": 5, "openDurationMs": 30000, "halfOpenSuccessesRequired": 3, "countsOnlyTransientFailures": true }, "identity": { "credential": "short-lived-delegated-jwt", "issuer": "oshun-auth", "audience": "metis-workbench-api", "maximumTtlSeconds": 60, "actorSubject": "oshun-bff", "requiredClaims": ["act", "aud", "exp", "iat", "iss", "jti", "nbf", "scope", "sub", "tid"], "exactViewScopeTemplate": "metis:eve:read:", "tenantAuthorityClaim": "tid", "forwardedTenantHeaderIsAuthoritative": false, "browserBearerForwardingAllowed": false, "refreshTokenForwardingAllowed": false, "coarseRoleClaimAuthorizesViews": false, "rejectTenantParameterMismatch": true, "upstreamReauthorizesSubjectTenantAndScope": true, "propagatedTraceHeaders": ["traceparent", "tracestate", "x-correlation-id", "x-request-id"], "secretOrTokenLoggingAllowed": false }, "degradedBehavior": { "timeout": { "status": 504, "code": "metis_timeout" }, "serviceUnavailable": { "status": 503, "code": "metis_unavailable" }, "circuitOpen": { "status": 503, "code": "metis_unavailable" }, "upstreamContractViolation": { "status": 502, "code": "metis_contract_violation" }, "upstreamServerFailure": { "status": 502, "code": "metis_upstream_failure" }, "authenticationFailure": { "preserveStatus": 401, "code": "authentication_required" }, "authorizationFailure": { "preserveStatus": 403, "code": "authorization_refused" }, "retryAfterSecondsForUnavailable": 5, "emptySuccessAllowed": false, "directStoreFallbackAllowed": false, "inProcessFallbackAllowed": false, "staleCacheFallbackAllowed": false, "cachePolicy": "no-store", "auditedOutcome": "execution-failed" }, "compatibilityException": { "state": "authorized-for-implementation", "bypassesWholeMetisSevenDayStabilityWindow": true, "scope": "only-explicit-routes-under-/api/v1/eve/workbench-read", "registersViews": false, "routeAdmissionConditions": [ "explicit FastAPI route and operationId exist in the canonical OpenAPI artifact", "bearer security and exact delegated scope are declared and enforced", "the route response schema is present in the pinned Eve OpenAPI slice", "the BFF decoder and FastAPI contract tests pass for the same slice digest", "authorization, timeout, service-loss, malformed-payload, and version-mismatch controls fail loud", "the data classification is ratified for exposure or the view contains only already-public data" ], "productionActivationRequiresNamedRatification": true }, "rejectedOptions": [ { "id": "direct-store", "reason": "It bypasses Metis authorization and service invariants, couples Eve to migrations and physical stores, and violates the proposed owner boundary." }, { "id": "current-in-process-metis-adapter", "reason": "It is a partial Oshun member adapter with truthful empty placeholders, not the Metis workbench authority or an independently authorizing boundary." }, { "id": "browser-next-proxy", "reason": "The /api/metis/v1 browser path is a client façade and forwards browser credentials; server-side Eve must not depend on a web application hop." }, { "id": "metis-node-api-gateway", "reason": "The /api/v1 gateway exposes only a small explicit subset of current FastAPI paths and cannot provide a generic or implied workbench route." }, { "id": "unversioned-fastapi-routes", "reason": "The current /api routes are the moving web contract; calling them directly would not create an independently versioned compatibility seam." } ], "prerequisites": [ { "id": "versioned-fastapi-facade", "state": "not-implemented", "ownerTaskId": "1.3", "condition": "Metis registers explicit GET routes under /api/v1/eve/workbench-read with OpenAPI operation IDs, schemas, and bearer security." }, { "id": "delegated-identity", "state": "not-implemented", "ownerTaskId": "1.3", "condition": "Platform Identity issues and Metis validates the down-scoped audience-bound JWT; tenant headers alone never authorize." }, { "id": "bounded-bff-client", "state": "not-implemented", "ownerTaskId": "1.3", "condition": "The Eve Metis adapter enforces this decision's deadlines, retry set, response cap, circuit breaker, schema decoder, and typed failures." }, { "id": "direct-fastapi-service-discovery", "state": "not-implemented", "ownerTaskId": "1.3", "condition": "OSHUN_METIS_API_BASE_URL resolves to the residency-correct FastAPI service origin, not port 4020, the browser proxy, or the incomplete Node gateway." }, { "id": "per-view-admission", "state": "not-implemented", "ownerTaskId": "1.3", "condition": "Each candidate independently passes the compatibility-exception conditions; this decision admits zero views by itself." } ], "ratification": { "implementationPosture": "effective-on-merge", "productionPosture": "blocked-pending-named-ratification", "reviewers": [ { "role": "Metis service owner", "status": "pending" }, { "role": "Platform Identity owner", "status": "pending" }, { "role": "Security owner", "status": "pending" }, { "role": "Data Governance", "status": "pending-for-protected-data" } ], "protectedDataAdditionalGate": "ADR-M0.5 must be ratified or superseded before protected learner, assessment, grade, integrity, or authoring records are exposed." }, "registeredViews": [], "limitations": [ "This decision authorizes an implementation direction and narrow compatibility exception; it does not claim that the versioned FastAPI façade, delegated identity, or bounded BFF client already exists.", "No Metis Eve view is registered by task 1.2; task 1.3 must prove every route independently.", "Named production ratification remains pending and is not inferred from agent authorship or a merged document.", "ADR-M0.5 remains Proposed, so this decision cannot admit protected or mixed-boundary data.", "The source observations are repository evidence, not a staging or production network probe." ] }, "recordDigestSha256": "dbd3282b6322eb206a7ef85bfb00635a74582f85d6e5448ce0fce0933f696ee4" }