API Gateway Default Route Proof Bundle

Status: bounded SVC-001 proof accepted, not gateway or rollout completion.

This page consolidates the route-specific evidence for SVC-001-default-route-proof-bundle. It proves that native IAM/Profile route candidates can be rehearsed through the gateway while the default route table remains the legacy rollback table. It does not approve a public default route promotion.

Route Diff

The reviewed candidates are:

• deploy/gateway/routes.auth-native-localhost-example.json
• deploy/gateway/routes.profile-native-localhost-example.json
• deploy/gateway/routes.organizations-read-native-localhost-example.json
• deploy/gateway/routes.organizations-membership-write-native-localhost-example.json
• deploy/gateway/routes.attempt-native-localhost-example.json
• deploy/gateway/routes.bff-admin-overview-native-localhost-example.json

The rollback/default table is deploy/gateway/routes.json. The candidate tables add only exact native route entries before their broad legacy fallback; the default table keeps the broad auth, admin, domain, and fallback routes on legacy_proxy. The gateway route-table coverage scripts reject native route names in the default table and validate route ordering, methods, targets, and target prefixes.

The 2026-07-10 rollback artifact records:

output/qa/iam-profile-route-rollback-20260710-svc001/summary.json
status=passed
defaultRouteTableModified=false
rollbackRouteTable=deploy/gateway/routes.json
auth/admin/fallback=legacy_proxy

Live/Browser Route Proof

Existing non-default runtime evidence was captured through api-gateway:

Workflow	Artifact	Result
IAM auth live gateway	output/qa/auth-route-live-20260709-115133/	Google config 200 via auth-google-config/native_read; unauthenticated /api/auth/me via auth-me/native_read; sibling legacy route stayed auth/legacy_proxy.
IAM auth browser	output/playwright/auth-route-browser-smoke-20260709-115940/	Real /auth/login; browser observed native auth headers and legacy sibling fallback.
IAM auth session browser	output/playwright/auth-route-session-browser-smoke-20260709-100744/	Register/login/refresh/logout lifecycle, refresh rotation, rejection of old/post-logout refresh, and redacted token artifacts.
Profile live gateway	output/qa/profile-route-live-20260709-121055/	Profile and teacher updates returned 200 through native gateway routes; GET /api/auth/me stayed legacy.
Profile browser	output/playwright/profile-route-browser-smoke-20260709-121825/	Real /teacher/profile update requests observed through native gateway routes; legacy auth sibling stayed legacy.
Candidate browser	output/qa/iam-profile-default-candidate-browser-20260709-095159/	Candidate read-only auth routes observed through the generated candidate table without modifying the default table.

The workflow command make test-auth-routes test-auth-routes-live test-auth-routes-browser test-auth-routes-session-browser test-profile-routes test-organization-routes test-attempt-routes test-bff-routes was run on 2026-07-10. Static coverage and self-tests passed. The live target intentionally stopped at its confirmation guard because no live promotion command may run without AUTH_ROUTE_LIVE_CONFIRM=auth-native; the confirmed live/browser artifacts above remain the runtime evidence for this bounded rehearsal.

Rollback Notes

Rollback is deterministic:

GATEWAY_ROUTE_TABLE=deploy/gateway/routes.json make run-gateway
make test-iam-profile-route-rollback

The latest static rollback artifact is output/qa/iam-profile-route-rollback-20260710-svc001/. Its exact native IAM/Profile carve-outs are absent from the rollback table and broad auth, admin, and fallback routes remain legacy_proxy. The earlier live candidate rollback artifact at output/qa/iam-profile-default-candidate-rollback-20260709-095948/ additionally observed the rollback headers through a running gateway and recorded defaultRouteTableModified=false.

Acceptance Boundary

• api-gateway remains the only public entry point for these rehearsals.
• iam-service remains the identity/access owner; profile-service remains the education profile owner.
• deploy/gateway/routes.json was not promoted or modified by this slice.
• Production-like IAM/Profile populated-target validation, UUID primary-key promotion, candidate approval, and final public default promotion remain open.

Verification

GOTOOLCHAIN=go1.25.11 go test ./services/api-gateway/... -count=1
make test-auth-routes
make test-profile-routes test-organization-routes test-attempt-routes test-bff-routes
make test-frontend-boundary
IAM_PROFILE_ROUTE_ROLLBACK_ARTIFACT_DIR=output/qa/iam-profile-route-rollback-20260710-svc001 make test-iam-profile-route-rollback

All commands above passed. The aggregate live workflow is confirmation-gated as described in the Live/Browser Route Proof section.