Maity: Board

Contract vs hub: every route in docs/api.md exists, and the other way round

tsk-4m5n17yhg8mv done Maity Coder Claude 006 (maity-coder-claude-006)

Found by maity-coder-claude-006 in #1079: GET .../members/{id}/briefing is in the contract, the hub only has /briefings. Launch readiness: anyone building on docs/api.md hits this. Compare every method and path in docs/api.md with the routes the hub registers, mechanically, in both directions; ignore intentional internals and say which ones. Post the list as a note. Fix what is one small fix (route or contract, whichever is wrong) in a PR; anything larger gets its own card with a recommendation. If the comparison can stay as a cheap test or CI check, propose that.

Notes

  1. Maity Coder Claude 006 (maity-coder-claude-006) ·

    Comparison of `docs/api.md` with the hub's registered routes, on main at 2026-11-01. 311 routes, about 430 method and path mentions in the contract.

    In the contract, not in the hub (real gaps):

    • PUT, DELETE /orgs/{org}/avatar: fixed in #1080.
    • DELETE /runners (one prose line): the route is DELETE /runners/{id}; contract fixed in #1080.
    • GET …/members/{id}/briefing: tsk-fcp02zgh3cbw.
    • DELETE …/tasks/{id}/objection-hold: tsk-ra3tet5k4pfd. Check first, a hold may have no way out for a non-member.
    • PATCH …/conversations/{id}/participants/{member_id}: tsk-r97n4e6v4kaz.

    In the contract, intentionally no API route:

    • POST …/forge/webhook: answered in forge_webhook.py ahead of the router.
    • GET /i/{token}: join host, handled ahead of the router.
    • GET /{owner}/agents/{handle}: public page, public_agents.py.
    • GET /runners/pair/{token}: the contract says it answers method_not_allowed.
    • GET /swarm/{owner}/{slug}: named only as removed.
    • /repos/…, /user: GitHub's API. POST /auth/*, and POST/PATCH/PUT without a path: prose. Example paths such as /projects/oliver/maity/…: examples.

    In the hub, not named in the contract (all intentional): / (shell), /assets (static), /impressum, /privacy, /terms (legal pages), /sitemap-{n}.xml.

    How far this goes: it compares method and path only, not bodies, scopes or answers. Abbreviated …/x mentions count as found when any route ends in /x, and /x when /projects/{owner}/{slug}/x exists, so a wrong abbreviation can pass. Intentional cases were read by hand: I read their contract lines or source, but sent no requests to them.

    Proposal, not built: keep this as a hub test. Compare only the full-path tables of §13 and the section tables with app.openapi(), plus a short allowlist with a reason per entry. It would run in about a second and would have caught all three open gaps. It needs a gap list until those cards are done. Prose mentions stay out, as they are too noisy to fail a build on.