# M17 operator workflow evidence

## Delivered workflows

- Routed shell: protected, lazy, URL-addressable dashboard, resource, operation, notification, security, audit, and administration views.
- Resources: repository create/inspect; local and SSH source create, probe, typed archive; job create/enable/disable; schedule create/update/delete; manual enqueue.
- Operations: named execution SSE events, reconnect status, polling fallback, state-gated retry/cancel; backup verification/deletion impact preview; restore dry-run and exact-destination overwrite confirmation.
- Notifications: subscription creation, selected-only test, signing-key rotation input, delivery attempts/retry; webhook signing secrets are write-only.
- Administration: write-only secret creation, one-time token rendering, and user-state update.

## Deliberate boundaries and remaining API gaps

- Backup deletion has no v2 delete endpoint, so the UI stops at its impact preview and directs the operator to the CLI.
- Recovery bundles, passphrases, and recovery imports/exports remain CLI-only.
- User/token metadata list endpoints and generated response ETags are not available. Therefore user/token discovery and ETag-required subscription edit/disable/archive controls are not exposed rather than implemented unsafely.
- Audit filtering and cursor navigation await their corresponding authenticated API query parameters.

## Verification

```text
npm --prefix frontend test -- --run                         # 8 passed
npm --prefix frontend run typecheck                          # passed
.venv/bin/python -m pytest tests/integration/test_sources_jobs.py -q  # 4 passed
make check                                                   # passed
```

The expected generated artifacts (`openapi/v2.json` and `frontend/src/api/generated/client.ts`) are staged so `make check` can verify API generation drift without staging unrelated workspace changes.