For: an agent or client can change a password and verify an email from the published contract alone, with the refusals it will meet.
Done:
[ ] POST /api/v1/user/password and POST /api/v1/user/email/verify (src/http/api.ts ~1390, ~1428) each have a row. The row sits in ROUTES (src/contract/openapi.ts) beside its neighbours, with the request body, each answer and each refusal the handler actually returns; its line(s) leave NOT_YET_DESCRIBED in test/openapi-coverage.test.ts.
[ ] A case in test/openapi-oa-acct.test.ts reads both rows from /api/v1/openapi.json and fails without them.
[ ] No handler changes behaviour.
Files: src/contract/openapi.ts, test/openapi-coverage.test.ts, test/openapi-oa-acct.test.ts.
Risk: describing a secret in an example; examples carry placeholders only.
For: an agent or client can change a password and verify an email from the published contract alone, with the refusals it will meet.
Done:
POST /api/v1/user/passwordandPOST /api/v1/user/email/verify(src/http/api.ts ~1390, ~1428) each have a row. The row sits inROUTES(src/contract/openapi.ts) beside its neighbours, with the request body, each answer and each refusal the handler actually returns; its line(s) leaveNOT_YET_DESCRIBEDin test/openapi-coverage.test.ts./api/v1/openapi.jsonand fails without them.Files: src/contract/openapi.ts, test/openapi-coverage.test.ts, test/openapi-oa-acct.test.ts. Risk: describing a secret in an example; examples carry placeholders only.