Admin Owner Source And Route Proof

Status: bounded SVC-023 proof accepted, not admin-service or rollout completion.

This artifact proves the admin foundation can identify and probe owner APIs while keeping source-of-truth data in the owning services. It does not promote the default gateway table or claim support-ticket persistence/moderation parity.

Owner Source Proof

GET /v1/admin/operations/source-map names an owner service and owner API for each dashboard/operations item. The source map keeps every item at routeStatus=legacy; admin-service does not read IAM, profile, wallet, payment, notification, import, classroom, exam, attempt, analytics, or audit databases directly.

GET /v1/admin/operations/source-snapshots accepts the configured ADMIN_OPERATIONS_SOURCE_TARGETS allow-list and reports owner HTTP health:

Source	Owner API	Runtime result
ai.providers	ai-classifier-service /v1/ai/providers/status	ok, HTTP 200 from disposable owner fixture
audit.history	audit-service /v1/audit-events	ok, HTTP 200 from disposable owner fixture
all other unconfigured keys	source-map owner API	unconfigured, with no synthetic total

The owner fixture listened only on 127.0.0.1:18100 for the rehearsal and was removed after verification. No shared or legacy database was changed.

Gateway Runtime And Browser Proof

The local rehearsal used admin-service on 127.0.0.1:8094 and the gateway on 127.0.0.1:18085 with test-only HS256 credentials and the non-default route tables. It verified:

• public GET /api/feature-maintenance/public reached the native route;
• authenticated global ADMIN GET /api/admin/feature-maintenance reached the native read route;
• authenticated global ADMIN PATCH /api/admin/feature-maintenance/{key} reached the native write rehearsal and persisted the feature state in the isolated in-memory store;
• unauthenticated admin list and audit requests were rejected with 401;
• authenticated GET /api/admin/operations/audit reached the native audit read route;
• browser navigation rendered the public feature response, authenticated admin feature response, audit response, and owner-source snapshot response.

Browser artifacts:

• output/playwright/svc023-admin-feature-maintenance-public.png
• output/playwright/svc023-admin-audit-route.png
• output/playwright/svc023-admin-owner-source-snapshots.png

Route State And Rollback

The default deploy/gateway/routes.json remains the active route table. The non-default feature-maintenance and admin-audit examples are rehearsal-only. Broad /api/admin*, /api/support*, operations commands, dashboard aggregation, and support ticket routes remain legacy-proxied.

Rollback is switching GATEWAY_ROUTE_TABLE back to deploy/gateway/routes.json, removing the non-default route entries, and disabling the owner-source target configuration if a source endpoint is unavailable or returns incompatible data. Do not promote a default admin route until route/browser evidence, response parity, tenant behavior, and rollback review are complete.

Verification

GOTOOLCHAIN=go1.25.11 go test ./services/admin-service/... -count=1
make test-feature-maintenance-routes test-admin-audit-routes
make test-audit-admin-compat-routes
make test-admin-owner-source-routes
make test-admin-owner-source-browser

All commands passed for SVC-023. The live rehearsal processes and disposable owner fixture were stopped; ports 8094, 18085, and 18100 were clear after cleanup.

Current Isolated Recheck (2026-07-13)

The isolated admin-service process used its in-memory store and the test-only owner target allow-list for ai.providers and audit.history. Both owner fixture endpoints required the internal service headers and returned HTTP 200; their source snapshots were ok. wallet.reviews and all remaining unconfigured sources remained unconfigured, so admin-service did not turn missing owner data into totals.

With the non-default deploy/gateway/routes.admin-owner-source-native-localhost-example.json, an ADMIN JWT received exact source-map and source-snapshots routes marked native_read. Anonymous traffic was rejected as AUTH_UNAUTHORIZED, and a TEACHER JWT was rejected as AUTH_FORBIDDEN. Playwright rendered the authenticated source-snapshot response at desktop and mobile viewports. These are API response captures, not admin dashboard UI parity proof.

Restarting the Gateway with active deploy/gateway/routes.json routed the same source-snapshot path through broad admin with legacy_proxy; the expected 502 used a deliberately unavailable legacy target. Headers, payloads, and assertions are in output/qa/admin-owner-source-route-proof-20260713/; browser captures are in output/playwright/admin-owner-source-route-proof-20260713/. The temporary owner fixture, admin-service, and Gateway were stopped after capture, and the default route table was not changed.

Current Admin Operations Browser Candidate (2026-07-15)

make test-admin-owner-source-browser starts a memory-only admin-service, an owner fixture, temporary api-gateway, and Admin Vite process on random loopback ports. Its only configured snapshot targets are ai.providers and audit.history; both fixture endpoints require X-Internal-Service: admin-service and the test-only internal token. The remaining sources, including wallet.reviews, stay explicitly unconfigured rather than becoming synthetic admin totals.

The temporary candidate route table served exact source-map and source-snapshot reads to an ADMIN session. Anonymous access returned 401; TEACHER returned 403. The actual Admin Operations page at /admin/operations?adminOperationsGateway=native rendered all 20 source statuses and successfully used the reload control through admin-operations-source-snapshots / native_read in desktop and mobile Playwright contexts. The direct Gateway source-snapshot check took 1.47 ms; desktop and mobile browser observations were 16 ms and 17 ms.

After the candidate browser closed, the temporary Gateway restarted with deploy/gateway/routes.json; the same request selected broad admin with legacy_proxy and returned the expected 502 from the intentionally unavailable proof legacy target. Artifact output/qa/admin-owner-source-browser-local-runtime-20260715-035834/ contains redacted request traces, owner-fixture authentication evidence, and desktop/mobile screenshots. All temporary processes and their runtime directory were removed on exit. This is a source-status UI candidate, not full dashboard or production parity evidence.