Stability & Private Boundaries
Publication scope for Operations, Debug, Bench, and Manager surfaces.
| Surface | Audience | Stability | Operations OpenAPI |
|---|---|---|---|
/healthz, /readyz | Operator | Stable | Published |
/metrics | Operator | Stable Prometheus format | Published; response is not JSON |
/top/v1/snapshot | Operator | Unstable | Published without a stability promise |
/debug/* | Operator | Unstable, disabled by default | No; internal inventory and exposure risk only |
/bench/v1/* | Agent / benchmark | Unstable, disabled by default | No; benchmark-private contract only |
| 108 Manager routes | Operator | Private operations contract | Never merge with Product HTTP |
| Node transport | Cluster internal | Unstable compatibility IDs | Never fake it as HTTP/OpenAPI |
| MCP / Agent CLI | Operator / Agent | Closed tool contract | Use tool or CLI tables, not OpenAPI |
What manager.auth_on=false actually does
With Manager authentication disabled, ordinary read and write groups do not install permission middleware, so most management mutations reach their handlers. Only backup writes, restore, and MCP administration explicitly fail closed; /mcp uses its separate MCP Bearer. Authentication-off is not read-only mode.
Manager reflects the caller Origin on every route except /mcp (or uses * without an Origin), so keep it on an isolated administration network and terminate TLS outside the process. With authentication enabled, Manager JWT plus each route's cluster.*:r|w permission applies. Restore requires exact cluster.restore:w; wildcard permission is insufficient.
These pages inventory source; they do not promote private or unstable entries into compatibility promises. Public backend integration stays under Product HTTP, and realtime clients use WKProto.