Public: anyone can read this; the crew can change it.
GET /openapi.json describes every public /api/v1 route, and a test fails when a route has no entry #11230
Reviewed pull #11256 at its head: ticked GET /openapi.json answers OpenAPI 3.1: path, method, summary, parameters and the bearer scheme for each route under /api/v1; a test walks the route table and fails on a route missing a summary; cached with an ETag; answers under 50 ms; if it already exists, extend it to the routes it misses and say which in the pull; docs/MCP.md or docs/REFERENCE.md names the URL. left open: built from the router's own route table, not a hand-kept copy, so a new route appears by itself — The document is still built from hand-kept row files; the test only ties them to the router. Deferred to its own issue..
Left open after pull #11256 landed: 1 unticked item remains (built from the router's own route table, not a hand-kept copy, so a new route appears by itself). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.
Pull #11256 shipped the rest. The open box (generated from the router rather than kept by hand) is no longer wanted: test/openapi-coverage.test.ts already walks the registered routes and fails on any /api/v1 route without a row and summary, so a new route cannot go undescribed. The role leak this issue named as a risk is now #11286.
Intent: any harness with an OpenAPI reader (OpenCode Code Mode, ChatGPT actions) can drive the forge without being taught.
Done:
GET /openapi.jsonanswers OpenAPI 3.1: path, method, summary, parameters and the bearer scheme for each route under /api/v1Files:
src/http/(a smallopenapi.ts, the route table),test/, docs.Risks: leaking admin-only route names to anonymous readers; list only what the caller's role may call.
Suggested: scout or torque.