Teacher Exam Blueprint BFF Route Rehearsal

Status: bounded native matrix proof. This does not promote deploy/gateway/routes.json or claim authenticated browser proof.

Scope

• exam-service owns exam_blueprints and exam_blueprint_rules.
• BFF exposes teacher-scoped matrix CRUD without a primary business database.
• Gateway rehearsal maps only the five /api/teacher/exam-blueprints* paths.
• Question-bank selection, matrix-to-exam generation, AI generation, and default route activation remain out of scope.

Static And Hermetic Checks

make test-teacher-exam-blueprint-bff-routes

This verifies both non-default route tables, default fallback retention, role/organization guards, path rewrites, removal of forged actor headers, and student/missing-organization denial in the Gateway unit test.

Local Persistence Evidence

On 2026-07-12, exam-service-migrations applied 000008_exam_blueprints.sql to hoctapaz_exam_db. The rebuilt service at http://127.0.0.1:8090 then completed this isolated workflow:

1. Teacher created QA Ma tran Dai so 10 with one rule.
2. Teacher replaced title and rules; PostgreSQL showed one geometry rule.
3. A different teacher received HTTP 404 for the private matrix.
4. ADMIN created a system matrix, which the other teacher could list.
5. Teacher deleted the private matrix; ADMIN deleted the system matrix.
6. A guarded database query confirmed zero remaining rows for the QA organization.

The direct BFF workflow at http://127.0.0.1:8102 also created, replaced, and deleted one matrix. It returned the updated geometry rule and left zero remaining QA rows.

Frontend Proof

packages/ui unit coverage seeds an authenticated Gateway session and selects ?teacherExamBlueprintGateway=native, then loads the matrix list from /api/teacher/exam-blueprints, edits a rule, and verifies the PATCH body and bearer token. Without the explicit candidate query, the same panel remains on local fixtures and makes no fetch request, including with a stored session.

Promotion Gates

• deploy/gateway/routes.json remains unchanged.
• The current teacher browser route has no authenticated real-Gateway browser smoke or rollback capture for this adapter.
• Do not claim matrix-to-question selection, online/offline exam generation, or AI matrix generation from this proof.