Profile, Admin, And BFF Route Rehearsals

These route rehearsals are non-default gateway proofs. They keep the default deploy/gateway/routes.json table legacy-safe while agents validate native read/write slices through explicit route tables.

Static Targets

Run the static route checks before any live proof:

make test-profile-routes
make test-profile-routes-live
make test-profile-kyc-routes
make test-profile-admin-kyc-routes
make test-feature-maintenance-routes
make test-admin-audit-routes
make test-audit-admin-compat-routes
make test-bff-routes

The checks compare the default legacy route table with the non-default Compose and localhost tables, including:

• deploy/gateway/routes.profile-native-{example,localhost-example}.json
• deploy/gateway/routes.profile-kyc-native-{example,localhost-example}.json
• deploy/gateway/routes.profile-admin-kyc-native-{example,localhost-example}.json
• deploy/gateway/routes.feature-maintenance-native-{example,localhost-example}.json
• deploy/gateway/routes.admin-audit-native-{example,localhost-example}.json
• deploy/gateway/routes.audit-admin-compat-native-{example,localhost-example}.json
• deploy/gateway/routes.bff-admin-overview-native-{example,localhost-example}.json

Live Runtime

For local live checks, start api-gateway with the matching localhost table:

GATEWAY_ROUTE_TABLE=deploy/gateway/routes.profile-native-localhost-example.json
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.profile-kyc-native-localhost-example.json
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.profile-admin-kyc-native-localhost-example.json
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.feature-maintenance-native-localhost-example.json
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.admin-audit-native-localhost-example.json
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.audit-admin-compat-native-localhost-example.json
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.bff-admin-overview-native-localhost-example.json

Use only frontend-through-gateway or approved BFF calls for browser proof. Do not call owner services directly from frontend apps, and do not promote default routes from service-local tests alone.

Latest profile update live proof:

• Artifact: output/qa/profile-route-live-20260709-121055/
• PATCH /api/auth/me/profile: 200, X-Hoctapaz-Gateway-Route: profile-base-update, state native_write.
• PATCH /api/auth/me/teacher-profile: 200, X-Hoctapaz-Gateway-Route: profile-teacher-update, state native_write.
• GET /api/auth/me: 502, X-Hoctapaz-Gateway-Route: auth, state legacy_proxy; the 502 is expected because the legacy target was a deliberate dummy endpoint.

Latest profile update browser proof:

• Artifact: output/playwright/profile-route-browser-smoke-20260709-121825/
• Page: http://localhost:5212/teacher/profile.
• PATCH /api/auth/me/profile: 200, X-Hoctapaz-Gateway-Route: profile-base-update, state native_write.
• PATCH /api/auth/me/teacher-profile: 200, X-Hoctapaz-Gateway-Route: profile-teacher-update, state native_write.
• GET /api/auth/me: 502, X-Hoctapaz-Gateway-Route: auth, state legacy_proxy; the 502 is expected because the legacy target was a deliberate dummy endpoint.

Rollback

Rollback is switching api-gateway back to:

GATEWAY_ROUTE_TABLE=deploy/gateway/routes.json

Record the static target output, route table used, actor/token role, and rollback confirmation before requesting default route promotion.