Handoff: SVC-023-admin-owner-source-route-proof admin-service owner source route proof

Scope

• Service/area: admin-service
• Task ID: SVC-023-admin-owner-source-route-proof
• Goal: prove admin source maps use owner APIs/source snapshots and attach local gateway runtime/browser proof with explicit rollback notes before any default admin promotion.
• Non-goals: default route promotion, support-ticket persistence, recipient discovery, mutating moderation parity, audit-service storage migration, dashboard aggregation, IAM/profile/payment/wallet ownership changes, or changes to legacy source under /Users/velikho/Desktop/WORKING/HOCTAPAZ/.

Docs Read

• docs/agents/handoff-phase-9-admin-foundation.md
• docs/agents/service-tasks/admin-service.md
• docs/agents/handoffs/SVC-023-support-moderation-source-contract.md
• docs/agents/service-agent-next-slice-queue.json
• docs/agents/service-agent-next-slice-closeout-ledger.json
• docs/agents/agent-handoff-format.md
• docs/api/admin-service.md
• docs/qa/admin-owner-source-route-proof.md
• docs/qa/profile-admin-bff-route-rehearsals.md
• docs/qa/service-agent-goal-completion-audit.md
• docs/qa/service-agent-readiness-smoke.md
• docs/runbooks/local-development.md

Legacy Evidence Read

• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/admin/feature-maintenance.service.ts
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/admin/operations.controller.ts
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/admin/admin-dashboard.controller.ts
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/admin/inbox.controller.ts
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/support/support.service.ts
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/common/feature-maintenance.guard.ts
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/prisma/schema.prisma
• Legacy source was read-only evidence; no legacy admin/support table, route, or source file was changed.

Files Changed

• services/admin-service/internal/usecase/admin_owner_source_test.go
• services/admin-service/internal/http/server.go
• services/admin-service/internal/http/server_test.go
• docs/api/admin-service.md
• docs/qa/admin-owner-source-route-proof.md
• docs/index.md
• docs/.vitepress/config.ts
• docs/agents/handoffs/SVC-023-admin-owner-source-route-proof.md
• docs/agents/service-agent-next-slice-closeout-ledger.json
• docs/agents/service-agent-next-slice-closeout-ledger.md
• docs/agents/service-agent-accepted-handoffs.md
• docs/qa/service-agent-goal-completion-audit.md
• docs/qa/service-agent-readiness-smoke.md
• Runtime artifacts: output/playwright/svc023-admin-feature-maintenance-public.png, output/playwright/svc023-admin-audit-route.png, and output/playwright/svc023-admin-owner-source-snapshots.png.
• No default gateway route, migration, owner service, IAM/profile boundary, or legacy file was changed.

Behavior Implemented

• Added a regression test requiring every admin operations source-map item to have a unique owner service, owner API, and routeStatus=legacy until promotion evidence exists.
• Existing source snapshots were verified against configured owner HTTP endpoints. ok owner responses are preserved as status/latency/HTTP evidence; unconfigured and unavailable owners remain explicit and do not become synthesized dashboard totals.
• Native owner-source map and snapshot routes now require an authenticated ADMIN actor at the admin-service boundary; anonymous, identity-less, and non-admin direct calls are rejected before any owner-source read.
• Existing gateway rehearsals were exercised through a real local api-gateway and admin-service process with test-only credentials. Native feature-maintenance public/list/update and admin audit reads preserved route headers and global ADMIN enforcement.

Tests And Verification

• Command: GOTOOLCHAIN=go1.25.11 go test ./services/admin-service/...
• Result: passed with -count=1.
• Evidence: admin HTTP, use-case, owner-source reader, notification sink, audit sink, owner/API/legacy-status regression, and direct owner-source admin-boundary tests passed.
• Command: make test-feature-maintenance-routes test-admin-audit-routes
• Result: passed.
• Evidence: default route table stayed legacy; non-default Compose and localhost tables kept exact native feature-maintenance/admin-audit routes, auth, role, ordering, and targets.
• Command: make test-audit-admin-compat-routes
• Result: passed.
• Evidence: audit-service compatibility preview remained a separate non-default route and did not alter admin-service default routing.
• Runtime verification: local admin-service on :8094 plus gateway on :18085 passed public native read, ADMIN list, ADMIN PATCH, ADMIN audit read, route headers, and unauthenticated 401 rejection.
• Owner-source verification: disposable owner endpoints on :18100 returned HTTP 200 and admin source snapshots reported ai.providers=ok and audit.history=ok; all processes and ports were cleaned up.
• Browser verification: Playwright rendered the public feature response, authenticated admin response, audit response, and owner-source snapshot response; screenshots are recorded under output/playwright/.
• Command: GOTOOLCHAIN=go1.25.11 go test -race ./services/admin-service/internal/http ./services/admin-service/internal/ownersource -count=1
• Result: passed.
• Current isolated runtime recheck: admin-service on :8094 used its in-memory store and probed two disposable owner endpoints on :18100 through ADMIN_OPERATIONS_SOURCE_TARGETS. The ai.providers and audit.history keys returned ok with HTTP 200; wallet.reviews and every other unconfigured source remained explicitly unconfigured. The owner fixture required X-Internal-Service: admin-service and the test-only internal token.
• Current gateway/browser recheck: the non-default owner-source route table on :18085 returned native_read for exact source-map and source-snapshot reads to an ADMIN JWT, rejected anonymous traffic with AUTH_UNAUTHORIZED and a TEACHER JWT with AUTH_FORBIDDEN, and rendered the authenticated snapshot JSON in Playwright desktop/mobile captures. Restarting the Gateway with the active default table returned the broad admin route with legacy_proxy and the expected 502 from a deliberately unavailable legacy target. Evidence is retained in output/qa/admin-owner-source-route-proof-20260713/ and output/playwright/admin-owner-source-route-proof-20260713/; all temporary processes were stopped.
• Command: pnpm docs:build
• Result: passed after adding the QA page and VitePress links.
• Command: git diff --check
• Result: passed.

Current Working-Tree Re-verification

On 2026-07-14, configured owner-source snapshots changed from serial probing to bounded parallel probing, with at most eight requests in flight. The reader keeps the configured source-map order and reports each source status independently. The gated TestHTTPReaderProbesConfiguredTargetsConcurrently requires both configured owner targets to begin before either response is released; it passed 100 consecutive runs.

• GOTOOLCHAIN=go1.25.11 go test ./services/admin-service/... -count=1, GOTOOLCHAIN=go1.25.11 go test -race ./services/admin-service/... -count=1, and GOTOOLCHAIN=go1.25.11 go vet ./services/admin-service/... passed.
• make test-admin-owner-source-routes test-admin-audit-routes test-feature-maintenance-routes passed.
• This changes no database ownership or default Gateway route and is not production dashboard-metric parity evidence.

Current Admin Operations Browser Candidate (2026-07-15)

• Command: make test-admin-owner-source-routes and make test-admin-owner-source-browser passed, followed by the focused admin-service suite and race checks.
• Runtime: a memory-only admin-service read only two configured owner fixture endpoints. Both required X-Internal-Service: admin-service plus the test-only internal token and returned HTTP 200; wallet.reviews remained unconfigured and no owner database was read.
• Browser: actual Admin Operations at /admin/operations?adminOperationsGateway=native rendered all 20 source statuses in desktop and mobile contexts, then reload used the exact admin-operations-source-snapshots native_read route again. ADMIN was allowed, anonymous was 401, and TEACHER was 403. The direct Gateway check took 1.47 ms; browser observations took 16 ms and 17 ms.
• Rollback: restarting the temporary Gateway with deploy/gateway/routes.json returned broad admin / legacy_proxy and the expected unreachable-legacy 502. Artifact: output/qa/admin-owner-source-browser-local-runtime-20260715-035834/; its browser request records Bearer [redacted] only. All temporary processes and the runtime directory were removed.

Required Evidence

• owner-service source proof: GET /v1/admin/operations/source-map names owner services/APIs for each source, GET /v1/admin/operations/source-snapshots probes only configured targets, and the disposable owner runtime returned ok without database joins or synthesized totals.
• route/browser proof: real gateway requests and Playwright navigation passed for feature-maintenance public/admin routes, admin audit read, and the owner-source snapshot response; default routing remained legacy.
• rollback notes: deploy/gateway/routes.json remained active; the rehearsal can be rolled back by switching GATEWAY_ROUTE_TABLE back to that file and disabling owner target configuration.
• current isolated evidence: output/qa/admin-owner-source-browser-local-runtime-20260715-035834/ records current owner-map metadata, owner status, role/anonymous rejections, internal fixture authentication, default rollback headers, and actual Admin Operations desktop/mobile renders. It remains source-status UI evidence, not dashboard UI or production parity evidence.

Route State

• Legacy route: default deploy/gateway/routes.json keeps broad /api/admin*, /api/support*, /api/feature-maintenance*, /api/admin/operations*, and fallback traffic on legacy.
• Native route: non-default examples rehearse only GET /api/feature-maintenance/public, GET /api/admin/feature-maintenance, PATCH /api/admin/feature-maintenance/{key}, and GET /api/admin/operations/audit with gateway auth and global ADMIN checks where required.
• Gateway state: mutating support/moderation implementation is blocked until the support owner and recipient-resolution contract are named. This handoff does not approve default promotion.
• Delegated gateway scope: route proof only; default gateway route tables remain orchestrator-owned.
• Rollback notes: switch GATEWAY_ROUTE_TABLE back to deploy/gateway/routes.json, remove non-default route entries, and disable ADMIN_OPERATIONS_SOURCE_TARGETS if owner responses regress. Review response parity, tenant behavior, browser/runtime evidence, and rollback before promotion.

Data Notes

• Tables touched: none outside the isolated in-memory admin store; no shared or legacy database was modified.
• Migration run: none.
• Validation report: disposable owner fixture on 127.0.0.1:18100, admin-service :8094, and gateway :18085 were stopped; no rehearsal process remained.

Risks / Blockers

• Support ticket owner API and recipient-resolution source are still unnamed for mutating support/moderation workflows.
• Default admin/dashboard/operations routes still require broader response parity, tenant behavior, and route/browser rollback review.
• Admin source snapshots prove owner reachability and status only; they are not dashboard metric parity or production monitoring.
• The current browser captures render a protected JSON response only; admin-web operations UI parity remains a separate frontend proof.
• IAM/Profile production-like populated-target cutover remains open for the broader goal.

Next Step

• Name the support ticket owner and recipient-resolution contracts, then add a separate bounded support/moderation route slice with owner API, audit/notification fanout, browser proof, and rollback evidence before any public default admin promotion.