← WI-068 Platform Foundations — floor (id/idempotency/correlation convention, keyless CI floor, legacy-quarantine registry) ★ Live Board · Overview WI-070 Scan Session & Orchestration — session identity + candidate lineage + next-scan execution →

WI-069 · Platform & Contracts · platform-foundations-api

Platform Foundations — app/edge API envelope + DTO boundary (implements the G12 invocation decision)

queued P1 medium risk   Owner: Paul   Reviewer: Paul   0% · 0/1 tasks complete

Gates: P9 Requirements: — Updated: 2026-06-22

At a glance

CodeWI-069
PhasePlatform & Contracts
Order30 of 93
Story points8
Primary surfaceTyped app/edge API + public/buyer/seller/internal DTOs
Retires—
Depends onData authority & RLS foundation (tenants/memberships/roles/permissions/assignments, auth helpers, deny-by-default membership RLS, schema+migration contract, demo parity)
Blocks—
Evidence
queued (P9 API — after G12 decision + P6 WI-015)

Goals

Give the web/mobile/MCP surfaces one typed contract over the P-gate domain functions, with strict DTO separation so no app route leaks base-table rows.

Spec document

P9-platform-foundations → · source ↗

Implementation — what to build

API envelope

  • Typed request/response envelope over the P-gate domain functions for app/mobile/server.

DTO boundary

  • public / buyer_private / seller_private / internal DTO separation; consume P6 public-safe views; no base-table leakage.

Invocation (G12)

  • Implement the chosen invocation style; service-role server-only; tenant/actor server-resolved.

Invocation = gateway (D33)

  • Server/edge gateway is the single front door; clients call it, never Supabase directly; the gateway hosts the P8 budget handshake + P7 actor resolution + P6 projections.

Checklist

  • ○ P9 Platform Foundations: app/edge API envelope + DTO boundary, ID/idempotency/correlation convention, cross-version compatibility registry, keyless CI floor, and the legacy-route quarantine registry that blocks P&C exit on any contract bypass.

Gates & testing

  • ○ P9 Platform Foundations: app/edge API envelope + DTO boundary, ID/idempotency/correlation convention, cross-version compatibility registry, keyless CI floor, and the legacy-route quarantine registry that blocks P&C exit on any contract bypass.
    CODE TEST

Requirements

No linked requirements.

Verify (done when)

One typed app/edge API envelope behind a server/edge gateway (D33: Next.js routes / Cloudflare Workers — not direct client→Supabase); public / buyer-private / seller-private / internal DTOs separated; routes consume P6 public-safe views/RPCs (no base-table rows where a projection is required); tenant/actor resolved server-side; service-role server-only. Per P9 spec + D33.

Cost triggers

No paid API / infra spend triggered by this item.

Status & editing

queued   Sprint: P&C Wave 4: Data & Surfaces

Edit status / sprint on the ★ Live Board → — changes are logged live with who / when / why.

Human-in-the-loop

No human tasks linked.

Findings

None recorded yet.

Concerns

  • Depends on P6 WI-015 public-safe views. G12 RESOLVED (D33): server/edge gateway.

Risks

None recorded yet.

Tech debt

None recorded yet.

Tools used

No tool calls recorded.

Files & artifacts

No files / artifacts recorded.

Update log

No log entries yet.