backup-tool/docs/release/m13-foundation-evidence.md

M13 UI/OpenAPI evidence

• OpenAPI is deterministically exported to openapi/v2.json; generated browser client drift is checked by npm --prefix frontend run api:check.
• text/event-stream is declared in OpenAPI for execution events. The generated client intentionally emits executionEventsUrl(...) -> URL, not a misleading JSON Promise; UI opens that URL using browser EventSource.
• Notification delivery retry requests send an Idempotency-Key and the browser CSRF header.
• Recovery status is CLI/runbook-only. The browser has no export, import, bundle, key, or passphrase transfer control.
• v2.1 PostgreSQL, MySQL, and TAR/download controls remain absent.

Green M13 checks

npm --prefix frontend test -- --run  # 9 passed
npm --prefix frontend run typecheck  # passed
npm --prefix frontend run build      # passed
npx --prefix frontend playwright test --config frontend/playwright.config.ts  # 1 passed
.venv/bin/python tools/export_openapi.py --check openapi/v2.json  # current
npm --prefix frontend run api:check  # current

Final verification: make check passed — 90 unit/contract, 61 integration, 14 fault, and 28 security tests; Ruff, mypy, TypeScript, and the frontend build passed. git diff --check and the staged-file check also passed.