{
  "schemaVersion": 1,
  "capturedAt": "2026-07-19",
  "description": "Machine-readable coverage claim manifest for Azure spec discovery. Source of truth for every currently advertised route and every planned explicit unsupported route. validationState=live requires a matching passing case in validation/evidence/live-azure-surfaces.json; unit tests alone never promote a route to live. plannedLiveEvidenceCase maps R8 harness case ids while validationState remains unit-only until sanitized pass evidence exists. requires-capability evidence never backs live.",
  "advertisedProviders": [
    "apim",
    "api-center",
    "app-service",
    "custom-apis",
    "logic-apps",
    "template-specs",
    "event-grid",
    "service-bus",
    "function-bindings",
    "iac-local"
  ],
  "routes": [
    {
      "id": "repo.spec.named-file",
      "provider": "repo",
      "route": "named-openapi-swagger-file",
      "implementationFiles": [
        "src/lib/repo/specs.ts",
        "src/lib/repo/scan.ts",
        "src/lib/resolve/source-selector.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-yaml",
        "openapi-json"
      ],
      "requiredCapability": "none (local filesystem)",
      "positiveTests": [
        "tests/runtime.test.ts",
        "tests/source-selector.test.ts",
        "tests/cli.integration.test.ts"
      ],
      "negativeTests": [
        "tests/source-selector.test.ts"
      ],
      "securityTests": [
        "tests/path-confinement.test.ts"
      ],
      "paginationTests": [],
      "validationState": "local-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "Local filesystem OpenAPI/Swagger short-circuit; no Azure network path. Covered by unit/integration tests and local CLI fixtures."
    },
    {
      "id": "iac-local.arm-embedded",
      "provider": "iac-local",
      "route": "arm-compiled-bicep-embedded-openapi",
      "implementationFiles": [
        "src/lib/providers/iac-local.ts",
        "src/lib/repo/azure-iac-scanner.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "none (local filesystem)",
      "positiveTests": [
        "tests/iac-local-provider.test.ts",
        "tests/runtime.test.ts"
      ],
      "negativeTests": [
        "tests/iac-local-provider.test.ts",
        "tests/iac-confinement.test.ts"
      ],
      "securityTests": [
        "tests/iac-confinement.test.ts",
        "tests/path-confinement.test.ts"
      ],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "iac-single",
      "unsupportedReason": null,
      "localOnlyRationale": null
    },
    {
      "id": "apim.http.explicit-api-id",
      "provider": "apim",
      "route": "explicit-api-arm-id",
      "implementationFiles": [
        "src/lib/providers/apim.ts",
        "src/lib/azure/clients.ts",
        "src/lib/resolve/source-selector.ts",
        "src/runtime.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/apim-provider.test.ts",
        "tests/runtime.test.ts",
        "tests/azure-clients.test.ts"
      ],
      "negativeTests": [
        "tests/runtime.test.ts",
        "tests/apim-provider.test.ts"
      ],
      "securityTests": [
        "tests/apim-provider.test.ts",
        "tests/sanitize.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "live",
      "liveEvidenceCase": "apim-explicit-api-id",
      "unsupportedReason": null,
      "localOnlyRationale": null
    },
    {
      "id": "apim.http.service-discovery",
      "provider": "apim",
      "route": "service-scoped-http-export",
      "implementationFiles": [
        "src/lib/providers/apim.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/apim-provider.test.ts",
        "tests/providers.test.ts",
        "tests/azure-clients.test.ts"
      ],
      "negativeTests": [
        "tests/apim-provider.test.ts",
        "tests/openapi-validation.test.ts"
      ],
      "securityTests": [
        "tests/apim-provider.test.ts",
        "tests/sanitize.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "live",
      "liveEvidenceCase": "apim-discovery",
      "unsupportedReason": null,
      "localOnlyRationale": null
    },
    {
      "id": "apim.http.workspace",
      "provider": "apim",
      "route": "workspace-scoped-http-export",
      "implementationFiles": [
        "src/lib/providers/apim.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/azure-clients.test.ts",
        "tests/apim-provider.test.ts"
      ],
      "negativeTests": [
        "tests/azure-clients.test.ts"
      ],
      "securityTests": [
        "tests/sanitize.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "Workspace-scoped APIM enumeration is unit-tested; public-Azure live matrix does not provision workspace APIs. Planned live case deferred until workspace inventory is disposable-safe."
    },
    {
      "id": "apim.revision.current-filter",
      "provider": "apim",
      "route": "current-revision-filter",
      "implementationFiles": [
        "src/lib/providers/apim.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/azure-clients.test.ts"
      ],
      "negativeTests": [
        "tests/azure-clients.test.ts"
      ],
      "securityTests": [],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "live",
      "liveEvidenceCase": "apim-version-set",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "apim.soap.wsdl-export",
      "provider": "apim",
      "route": "soap-wsdl-export",
      "implementationFiles": [
        "src/lib/providers/apim.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "wsdl"
      ],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/apim-provider.test.ts",
        "tests/azure-clients.test.ts"
      ],
      "negativeTests": [
        "tests/apim-provider.test.ts"
      ],
      "securityTests": [
        "tests/apim-provider.test.ts"
      ],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "apim-soap-wsdl",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "apim.graphql.sdl",
      "provider": "apim",
      "route": "graphql-sdl-retrieval",
      "implementationFiles": [
        "src/lib/providers/apim.ts",
        "src/lib/azure/clients.ts",
        "src/lib/spec/oas-derivation.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "graphql-sdl"
      ],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/apim-provider.test.ts",
        "tests/oas-derivation.test.ts",
        "tests/azure-clients.test.ts"
      ],
      "negativeTests": [
        "tests/apim-provider.test.ts"
      ],
      "securityTests": [],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "apim-graphql-sdl",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "apim.websocket",
      "provider": "apim",
      "route": "websocket-definition-export",
      "implementationFiles": [
        "src/lib/providers/apim.ts"
      ],
      "contractClass": "unsupported",
      "nativeFormats": [],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/apim-provider.test.ts"
      ],
      "negativeTests": [
        "tests/apim-provider.test.ts"
      ],
      "securityTests": [],
      "paginationTests": [],
      "validationState": "unsupported",
      "liveEvidenceCase": null,
      "unsupportedReason": "APIM WebSocket APIs have no documented definition-byte export route; they remain visible as manual-review candidates only.",
      "plannedLiveEvidenceCase": "apim-unsupported-websocket",
      "localOnlyRationale": null
    },
    {
      "id": "apim.grpc",
      "provider": "apim",
      "route": "grpc-proto-export",
      "implementationFiles": [
        "src/lib/providers/apim.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "protobuf"
      ],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/apim-provider.test.ts",
        "tests/azure-clients.test.ts"
      ],
      "negativeTests": [
        "tests/apim-provider.test.ts"
      ],
      "securityTests": [],
      "paginationTests": [],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "APIM gRPC text/protobuf schema list/get export is unit-tested end-to-end; the live harness currently provisions gRPC APIs without a protobuf schema (covered by apim-unsupported-grpc). Do not invent live pass evidence until a disposable protobuf schema fixture exists."
    },
    {
      "id": "apim.odata",
      "provider": "apim",
      "route": "odata-definition-export",
      "implementationFiles": [
        "src/lib/providers/apim.ts"
      ],
      "contractClass": "unsupported",
      "nativeFormats": [],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/apim-provider.test.ts"
      ],
      "negativeTests": [
        "tests/apim-provider.test.ts"
      ],
      "securityTests": [],
      "paginationTests": [],
      "validationState": "unsupported",
      "liveEvidenceCase": null,
      "unsupportedReason": "APIM OData APIs have no documented safe definition-byte export route; they remain visible as manual-review candidates only.",
      "plannedLiveEvidenceCase": "apim-unsupported-odata",
      "localOnlyRationale": null
    },
    {
      "id": "app-service.api-definition-url",
      "provider": "app-service",
      "route": "siteconfig-apidefinition-url",
      "implementationFiles": [
        "src/lib/providers/app-service.ts",
        "src/lib/fetch/spec-fetcher.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json",
        "openapi-yaml"
      ],
      "requiredCapability": "Reader (Microsoft.Web/sites read)",
      "positiveTests": [
        "tests/app-service-provider.test.ts",
        "tests/spec-fetcher.test.ts"
      ],
      "negativeTests": [
        "tests/app-service-provider.test.ts",
        "tests/spec-fetcher.test.ts"
      ],
      "securityTests": [
        "tests/spec-fetcher.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "live",
      "liveEvidenceCase": "app-service-api-definition",
      "unsupportedReason": null,
      "localOnlyRationale": null
    },
    {
      "id": "custom-apis.inline-swagger",
      "provider": "custom-apis",
      "route": "logic-apps-custom-connector-inline-swagger-or-wsdl",
      "implementationFiles": [
        "src/lib/providers/custom-apis.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json",
        "wsdl"
      ],
      "requiredCapability": "Reader (Microsoft.Web/customApis read)",
      "positiveTests": [
        "tests/custom-apis-provider.test.ts",
        "tests/azure-clients.test.ts"
      ],
      "negativeTests": [
        "tests/custom-apis-provider.test.ts",
        "tests/azure-clients.test.ts"
      ],
      "securityTests": [
        "tests/custom-apis-provider.test.ts",
        "tests/azure-clients.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": "custom-apis-inline-swagger",
      "localOnlyRationale": null
    },
    {
      "id": "logic-apps.request-trigger-synthesis",
      "provider": "logic-apps",
      "route": "consumption-request-trigger-partial-openapi",
      "implementationFiles": [
        "src/lib/providers/logic-apps.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "partial",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "Reader (Microsoft.Logic/workflows read)",
      "positiveTests": [
        "tests/logic-apps-provider.test.ts"
      ],
      "negativeTests": [
        "tests/logic-apps-provider.test.ts"
      ],
      "securityTests": [
        "tests/logic-apps-provider.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "live",
      "liveEvidenceCase": "logic-apps-reader-synthesis",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "template-specs.embedded-apim",
      "provider": "template-specs",
      "route": "template-spec-embedded-apim-openapi",
      "implementationFiles": [
        "src/lib/providers/template-specs.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "partial",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "Reader (Microsoft.Resources/templateSpecs read)",
      "positiveTests": [
        "tests/template-specs-provider.test.ts"
      ],
      "negativeTests": [
        "tests/template-specs-provider.test.ts"
      ],
      "securityTests": [
        "tests/template-specs-provider.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "live",
      "liveEvidenceCase": "template-specs-embedded-apim",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "event-grid.webhook-synthesis",
      "provider": "event-grid",
      "route": "webhook-delivery-partial-openapi",
      "implementationFiles": [
        "src/lib/providers/event-grid.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "partial",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "Reader (Microsoft.EventGrid read)",
      "positiveTests": [
        "tests/event-grid-provider.test.ts"
      ],
      "negativeTests": [
        "tests/event-grid-provider.test.ts"
      ],
      "securityTests": [
        "tests/event-grid-provider.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "live",
      "liveEvidenceCase": "event-grid-webhook-partial",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "service-bus.topic-publish-synthesis",
      "provider": "service-bus",
      "route": "topic-publish-partial-openapi",
      "implementationFiles": [
        "src/lib/providers/service-bus.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "partial",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "Reader (Microsoft.ServiceBus read)",
      "positiveTests": [
        "tests/service-bus-provider.test.ts"
      ],
      "negativeTests": [
        "tests/service-bus-provider.test.ts"
      ],
      "securityTests": [
        "tests/service-bus-provider.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": "service-bus-topic-partial",
      "localOnlyRationale": null
    },
    {
      "id": "function-bindings.trigger-synthesis",
      "provider": "function-bindings",
      "route": "trigger-binding-partial-openapi",
      "implementationFiles": [
        "src/lib/providers/function-bindings.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "partial",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "Reader (Microsoft.Web/sites/functions read)",
      "positiveTests": [
        "tests/function-bindings-provider.test.ts"
      ],
      "negativeTests": [
        "tests/function-bindings-provider.test.ts"
      ],
      "securityTests": [
        "tests/function-bindings-provider.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "Partial trigger-binding synthesis is unit-proven; must not share the authoritative OpenAPI-extension live case. Dedicated partial live case is not yet in the matrix."
    },
    {
      "id": "association.postman-repo-tag",
      "provider": "association",
      "route": "postman-repo-tag-selection",
      "implementationFiles": [
        "src/lib/resolve/narrowing-pipeline.ts",
        "src/lib/resolve/resource-graph-query.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "Reader plus Resource Graph query when tag lookup fallback is used",
      "positiveTests": [
        "tests/narrowing.test.ts",
        "tests/runtime.test.ts"
      ],
      "negativeTests": [
        "tests/narrowing.test.ts"
      ],
      "securityTests": [],
      "paginationTests": [
        "tests/resource-graph.test.ts"
      ],
      "validationState": "live",
      "liveEvidenceCase": "apim-clean-repo-tag",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "association.fox-github-org-repo",
      "provider": "association",
      "route": "fox-githuborg-githubrepo-selection",
      "implementationFiles": [
        "src/lib/resolve/narrowing-pipeline.ts",
        "src/lib/estate/enumerate.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "Reader (resource tags)",
      "positiveTests": [
        "tests/narrowing.test.ts",
        "tests/estate.test.ts"
      ],
      "negativeTests": [
        "tests/narrowing.test.ts",
        "tests/estate.test.ts"
      ],
      "securityTests": [
        "tests/estate.test.ts"
      ],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "apim-clean-repo-fox-pair",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "association.gateway-hostname-hint",
      "provider": "association",
      "route": "apim-gateway-hostname-service-hint",
      "implementationFiles": [
        "src/lib/repo/signals.ts",
        "src/lib/resolve/narrowing-pipeline.ts",
        "src/lib/providers/apim.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "none (local filesystem) for URL evidence; API Management Service Reader for hostname inventory",
      "positiveTests": [
        "tests/gateway-resolution.test.ts"
      ],
      "negativeTests": [
        "tests/gateway-resolution.test.ts"
      ],
      "securityTests": [
        "tests/azure-bindings.test.ts"
      ],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "apim-gateway-host-path",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "association.gateway-api-assignment",
      "provider": "association",
      "route": "self-hosted-or-workspace-gateway-api-assignment",
      "implementationFiles": [
        "src/lib/azure/clients.ts",
        "src/lib/providers/apim.ts",
        "src/lib/resolve/narrowing-pipeline.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/gateway-resolution.test.ts"
      ],
      "negativeTests": [
        "tests/gateway-resolution.test.ts"
      ],
      "securityTests": [],
      "paginationTests": [],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "Gateway API assignment narrowing is unit-proven in gateway-resolution tests; no distinct disposable live facet beyond host/path selection."
    },
    {
      "id": "association.exact-binding",
      "provider": "association",
      "route": "postman-resources-yaml-azure-binding",
      "implementationFiles": [
        "src/lib/repo/azure-bindings.ts",
        "src/runtime.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "none (local filesystem)",
      "positiveTests": [
        "tests/azure-bindings.test.ts",
        "tests/gateway-resolution.test.ts"
      ],
      "negativeTests": [
        "tests/azure-bindings.test.ts"
      ],
      "securityTests": [
        "tests/azure-bindings.test.ts"
      ],
      "paginationTests": [],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "Exact .postman Azure binding resolution is local filesystem association; covered by azure-bindings unit tests without Azure calls."
    },
    {
      "id": "association.clean-repo-host-path",
      "provider": "association",
      "route": "exact-gateway-host-and-api-path-selection",
      "implementationFiles": [
        "src/lib/repo/signals.ts",
        "src/lib/resolve/narrowing-pipeline.ts",
        "src/lib/providers/apim.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "API Management Service Reader",
      "positiveTests": [
        "tests/gateway-resolution.test.ts"
      ],
      "negativeTests": [
        "tests/gateway-resolution.test.ts"
      ],
      "securityTests": [],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "apim-gateway-host-path",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "association.app-service-container-apps-source-control",
      "provider": "association",
      "route": "app-service-container-apps-source-control-correlation",
      "implementationFiles": [
        "src/lib/azure/source-control-client.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "Reader (Microsoft.Web/sites/sourcecontrols read; Microsoft.App/containerApps/sourcecontrols read)",
      "positiveTests": [
        "tests/source-control-client.test.ts"
      ],
      "negativeTests": [
        "tests/source-control-client.test.ts"
      ],
      "securityTests": [
        "tests/source-control-client.test.ts"
      ],
      "paginationTests": [
        "tests/source-control-client.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "App Service and Container Apps source-control correlation is association-only (normalized repo URL + branch); unit-proven with bounded body reads, IAM fail-soft, and pagination ceilings. Not a specification provider and must not share App Service apiDefinition live evidence. Disposable live facet is not yet in the matrix."
    },
    {
      "id": "mode.discover-many",
      "provider": "runtime",
      "route": "discover-many-export-summary",
      "implementationFiles": [
        "src/runtime.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json"
      ],
      "requiredCapability": "Reader for each probed provider surface in scope",
      "positiveTests": [
        "tests/runtime.test.ts"
      ],
      "negativeTests": [
        "tests/runtime.test.ts"
      ],
      "securityTests": [
        "tests/sanitize.test.ts"
      ],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "discover-many",
      "unsupportedReason": null,
      "localOnlyRationale": null
    },
    {
      "id": "mode.discover-estate",
      "provider": "runtime",
      "route": "discover-estate-repo-association",
      "implementationFiles": [
        "src/lib/estate/enumerate.ts",
        "src/runtime.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "Reader plus Resource Graph query",
      "positiveTests": [
        "tests/estate.test.ts",
        "tests/contract.test.ts"
      ],
      "negativeTests": [
        "tests/estate.test.ts"
      ],
      "securityTests": [
        "tests/estate.test.ts"
      ],
      "paginationTests": [
        "tests/resource-graph.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "discover-estate repo-association roster is unit-tested; estate live proof is out of the current disposable matrix and must not reuse discover-many evidence."
    },
    {
      "id": "resolver.ambiguity",
      "provider": "runtime",
      "route": "fail-closed-ranked-candidates",
      "implementationFiles": [
        "src/lib/resolve/service-resolver.ts",
        "src/lib/resolve/source-selector.ts",
        "src/runtime.ts"
      ],
      "contractClass": "association-only",
      "nativeFormats": [],
      "requiredCapability": "none for local fixture ambiguity; Reader when cloud candidates are present",
      "positiveTests": [
        "tests/runtime.test.ts",
        "tests/source-selector.test.ts"
      ],
      "negativeTests": [
        "tests/runtime.test.ts",
        "tests/source-selector.test.ts"
      ],
      "securityTests": [
        "tests/sanitize.test.ts"
      ],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "ambiguity",
      "unsupportedReason": null,
      "localOnlyRationale": null
    },
    {
      "id": "api-center.definition-export",
      "provider": "api-center",
      "route": "api-center-definition-inventory-export",
      "implementationFiles": [
        "src/lib/azure/api-center-client.ts",
        "src/lib/providers/api-center.ts",
        "src/runtime.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json",
        "openapi-yaml",
        "asyncapi-json",
        "asyncapi-yaml",
        "wsdl",
        "wadl",
        "xsd",
        "protobuf",
        "graphql-sdl",
        "mcp-json"
      ],
      "requiredCapability": "Microsoft.ApiCenter read + definitions/exportSpecification/action (Service Reader); data-plane inventory optional and unused",
      "positiveTests": [
        "tests/api-center-client.test.ts",
        "tests/api-center-provider.test.ts"
      ],
      "negativeTests": [
        "tests/api-center-client.test.ts",
        "tests/api-center-provider.test.ts"
      ],
      "securityTests": [
        "tests/api-center-client.test.ts"
      ],
      "paginationTests": [
        "tests/api-center-client.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": "api-center-openapi-export",
      "localOnlyRationale": null
    },
    {
      "id": "repo.spec.native-formats-r3",
      "provider": "repo",
      "route": "bounded-content-detected-local-native-specs",
      "implementationFiles": [
        "src/lib/repo/discovery.ts",
        "src/lib/repo/specs.ts",
        "src/lib/repo/scan.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-yaml",
        "openapi-json",
        "asyncapi-yaml",
        "asyncapi-json",
        "wsdl",
        "wadl",
        "xsd",
        "protobuf",
        "graphql-sdl",
        "mcp-json"
      ],
      "requiredCapability": "none (local filesystem)",
      "positiveTests": [
        "tests/repo-discovery-r3.test.ts"
      ],
      "negativeTests": [
        "tests/repo-discovery-r3.test.ts"
      ],
      "securityTests": [
        "tests/repo-discovery-r3.test.ts"
      ],
      "paginationTests": [],
      "validationState": "local-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": "local-r3-format-parser-matrix",
      "localOnlyRationale": "Local-only compiled CLI native format/parser matrix; planned harness id local-r3-format-parser-matrix never promotes remote routes."
    },
    {
      "id": "logic-apps.native-list-swagger-r4",
      "provider": "logic-apps",
      "route": "opt-in-consumption-list-swagger",
      "implementationFiles": [
        "src/lib/providers/logic-apps.ts",
        "src/lib/azure/logic-apps-native-client.ts"
      ],
      "contractClass": "reconstructed",
      "nativeFormats": [
        "openapi-json",
        "openapi-yaml"
      ],
      "requiredCapability": "Microsoft.Logic/workflows/triggers/listSwagger/action",
      "positiveTests": [
        "tests/logic-apps-native-r4.test.ts"
      ],
      "negativeTests": [
        "tests/logic-apps-native-r4.test.ts"
      ],
      "securityTests": [
        "tests/logic-apps-native-r4.test.ts"
      ],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "logic-apps-list-swagger",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "app-service.documented-scm-spec-r4",
      "provider": "app-service",
      "route": "opt-in-apispecpath-scm-vfs",
      "implementationFiles": [
        "src/lib/providers/app-service.ts",
        "src/lib/azure/app-service-runtime-client.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json",
        "openapi-yaml"
      ],
      "requiredCapability": "documented App Service SCM/VFS access",
      "positiveTests": [
        "tests/app-service-r4.test.ts"
      ],
      "negativeTests": [
        "tests/app-service-r4.test.ts"
      ],
      "securityTests": [
        "tests/app-service-r4.test.ts"
      ],
      "paginationTests": [],
      "validationState": "live",
      "liveEvidenceCase": "app-service-apispecpath-runtime",
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": null
    },
    {
      "id": "function-bindings.openapi-extension-r4",
      "provider": "function-bindings",
      "route": "opt-in-evidenced-openapi-extension",
      "implementationFiles": [
        "src/lib/providers/function-bindings.ts",
        "src/lib/azure/functions-openapi.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json",
        "openapi-yaml"
      ],
      "requiredCapability": "documented Functions OpenAPI extension route",
      "positiveTests": [
        "tests/functions-openapi-r4.test.ts"
      ],
      "negativeTests": [
        "tests/functions-openapi-r4.test.ts"
      ],
      "securityTests": [
        "tests/functions-openapi-r4.test.ts"
      ],
      "paginationTests": [],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": "function-bindings-openapi-extension",
      "localOnlyRationale": null
    },
    {
      "id": "runtime-declared.explicit-https-r4",
      "provider": "runtime-declared",
      "route": "opt-in-explicit-https-target",
      "implementationFiles": [
        "src/lib/providers/runtime-declared-routes.ts",
        "src/lib/fetch/spec-fetcher.ts",
        "src/lib/spec/native-formats.ts",
        "src/lib/spec/native-filenames.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [
        "openapi-json",
        "openapi-yaml",
        "asyncapi-json",
        "asyncapi-yaml",
        "wsdl",
        "wadl",
        "xsd",
        "protobuf",
        "graphql-sdl",
        "mcp-json"
      ],
      "requiredCapability": "explicit named runtime target",
      "positiveTests": [
        "tests/runtime-declared-r4.test.ts"
      ],
      "negativeTests": [
        "tests/runtime-declared-r4.test.ts"
      ],
      "securityTests": [
        "tests/runtime-declared-r4.test.ts"
      ],
      "paginationTests": [],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "Explicit HTTPS runtime-declared routes are unit-tested under R4; live proof requires a dedicated disposable target distinct from App Service apiDefinition/SCM cases."
    },
    {
      "id": "platform.sovereign-cloud",
      "provider": "platform",
      "route": "sovereign-cloud-arm-endpoints",
      "implementationFiles": [
        "src/lib/azure/cloud.ts",
        "src/lib/azure/clients.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [],
      "requiredCapability": "cloud-specific ARM authority and credential scope (AZURE_ENVIRONMENT / authority host)",
      "positiveTests": [
        "tests/azure-clients.test.ts"
      ],
      "negativeTests": [
        "tests/azure-clients.test.ts"
      ],
      "securityTests": [
        "tests/azure-clients.test.ts"
      ],
      "paginationTests": [
        "tests/azure-clients.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "Sovereign cloud profile wiring is unit-tested; live promotion requires per-cloud pipeline evidence not present in the public-Azure matrix."
    },
    {
      "id": "platform.multi-subscription-scope",
      "provider": "platform",
      "route": "explicit-multi-subscription-and-scoped-absence",
      "implementationFiles": [
        "src/runtime.ts",
        "src/lib/azure/clients.ts",
        "src/lib/estate/enumerate.ts"
      ],
      "contractClass": "authoritative",
      "nativeFormats": [],
      "requiredCapability": "Reader (or provider-specific) on each explicitly selected subscription scope",
      "positiveTests": [
        "tests/multi-subscription-r6.test.ts",
        "tests/subscription-resolution.test.ts",
        "tests/estate.test.ts"
      ],
      "negativeTests": [
        "tests/multi-subscription-r6.test.ts",
        "tests/subscription-resolution.test.ts"
      ],
      "securityTests": [
        "tests/multi-subscription-r6.test.ts"
      ],
      "paginationTests": [
        "tests/resource-graph.test.ts"
      ],
      "validationState": "unit-only",
      "liveEvidenceCase": null,
      "unsupportedReason": null,
      "plannedLiveEvidenceCase": null,
      "localOnlyRationale": "Multi-subscription scope resolution is unit-tested; live proof requires authorized multi-sub disposable inventory outside the single-RG matrix."
    }
  ]
}