Eve SOTA — Metis mutation admission (task 1.5)

Evaluated: 2026-09-02

Decision: zero-write-verdict

Record digest: d0e093f15326657e018fb855fe54e18a47a6b1b87dacef964882903155ccfa41

Verdict#

Zero Metis mutations are admitted to Eve. The authoritative OpenAPI currently exposes 457 POST/PUT/PATCH/DELETE operations, but 0 live below the required versioned Eve write prefix and the BFF contains 0 Metis confirmation-card commands. Every write-method operation is inventoried in the machine record and below; none passes all 9 admission properties.

This is a positive boundary decision, not a claim that Metis has no useful mutation primitives. Existing Metis clients retain their current API. Eve stays zero-write because calling the moving /api surface directly would bypass the approved transport, delegated identity, card, and exact failure contracts.

Authoritative inventory#

Admission policy#

An operation is admitted only when every property below passes. A useful lower-level service primitive is not automatically a safe Eve command.

Strongest near misses#

Item-import commit spotlight#

The strongest policy-pinned review target is POST /api/item-bank/imports/{batch_id}/commits. It proves that the inventory does not erase useful safety work: required idempotency and preview witnesses, freshness checks, tenant isolation, append-only commit receipts, and exact item reconciliation are present. It remains not admitted because its unversioned route has no Eve delegated write scope or card, no bounded Eve client, no explicit reversible command boundary, and its OpenAPI publishes only the success/validation subset rather than the complete operational failure vocabulary. Controlled dependency loss returns a loud HTTP 500 instead of empty success; that is correct fail-loud behavior but not the typed 502/503/504 contract required for admission.

Complete write-method inventory#

Runtime proof posture#

• The canonical OpenAPI export is rechecked against the live FastAPI application; repository JSON alone is not treated as sufficient service evidence.
• The item-import API contract reaches the instructor route, rejects a learner before constructing the service, and observes dependency loss as a loud HTTP 500 rather than empty success.
• The isolated PostgreSQL gate proves idempotent replay, immutable append-only receipts, and cross-tenant non-disclosure for the spotlight near miss.
• Those primitives do not authorize an Eve write. The transport decision remains GET-only below /api/v1/eve/workbench-read, production activation remains unauthorized, and all upstream Metis views remain unregistered.

Review triggers#

• A mutation-specific transport decision authorizes an explicit route below /api/v1/eve/workbench-write.
• Metis validates an audience-bound delegated JWT with exact scope metis:eve:write:.
• The exact operation binds a confirmation-card preview witness, idempotency key, freshness precondition, and typed audit receipt.
• The OpenAPI declares typed authentication, authorization, target-absence, replay/staleness, and dependency-failure outcomes.
• A bounded BFF write client proves timeout, replay, malformed-payload, stale-version, service-loss, and injected-record controls without fallback success.
• Named Metis, Platform Identity, Security, and applicable Data Governance reviewers authorize production activation.

Limitations#

• This record inventories HTTP methods capable of mutation conservatively; some POST operations are computations, previews, searches, validations, or exports. They remain inventoried so a write-capable route cannot disappear through semantic relabelling.
• Signal detection records contract evidence but does not infer that a field name alone proves end-to-end safety. Admission is the conjunction of all nine properties and currently remains zero.
• The item-import spotlight is a near miss, not an Eve command. Its live PostgreSQL test proves local service behavior only; it does not create a versioned Eve transport, delegated token, card, bounded client, or production ratification.
• A loud generic HTTP 500 on controlled item-import dependency loss is not empty success, but it is also not the typed operational failure contract required for admission.
• This closes task 1.5 only. It does not register a Metis view or command, close Phase 1, close G4, or prove task 1.6 or 1.7.