Milestone 4.P.0 — Runtime Topology & Environment ContractCopy Anchor Link

Status: mounted-but-provisional — topology decision and closure evidence are required; no runtime closure is claimed here. Outcome: A server-capable canonical operator application runs against a separately owned API/SSE runtime, while web/ remains the public documentation site and services/dashboard/ remains a compatibility-only shell during migration. Track: Track P — Operator Readiness, Evidence & Control Plane Dependencies: P0 is the first node in the graph. Track A API foundations, Phase 3.5, and the 4.C.5 streaming baseline are external inputs, not evidence that P0 is closed. Estimated effort: 2 weeks Gate: G0 topology decision/closure

Decision and boundariesCopy Anchor Link

The canonical production-intended application is services/console, with a server-side data boundary and a separately managed API/SSE origin or an explicitly approved same-origin equivalent. web/ is public documentation. services/dashboard/ is a temporary compatibility-only shell for the existing 4.P.0 connection behavior; it is not the Track D operator product and must have a retirement condition.

The ADR must settle origin relationship, cookie and token audience, CSRF, CORS, TLS termination, ingress timeouts, SSE buffering and write deadlines, environment variables, and ownership for local, preview, staging, and production. It must not infer hostnames or deployment workflows from the readiness plan.

Scope and contractsCopy Anchor Link

• Publish health, dependency-aware readiness, startup, and drain behavior.
• Keep operator-event SSE framing, Last-Event-ID resume, reconnect, duplicate suppression, and drain semantics distinct from provider token streaming; provider streaming remains verbatim.
• Define versioned API envelopes with tenant/session context, pagination, stable errors, freshness/completeness, and redaction metadata.
• Keep public documentation deployment independent from authenticated operator deployment.

Verification and closureCopy Anchor Link

Closure evidence is the ADR, environment matrix, origin/security negative tests, authenticated runtime smoke transcript, operator SSE reconnect/drain transcript, and rollback to a prior evidence-backed console artifact/digest or operator-origin disablement. The transcript must identify commit, image or artifact digest, environment, command, and result. The compatibility shell may retain its own unit tests, but those tests cannot satisfy operator E2E.

Rollout and rollbackCopy Anchor Link

Trigger: topology mismatch, cookie/CORS failure, unsafe static export, or stream resource growth. Reversal: route to the prior evidence-backed console artifact/digest, or disable the operator origin if no such artifact exists; do not change stored data. Public web/ documentation remains independently available. Verify: unauthenticated operator access is rejected and the runtime smoke transcript is rerun.

Findings addressedCopy Anchor Link

F4-001, F4-007, F4-020, F4-033, F4-036, F4-037.

Exit checklistCopy Anchor Link

• Canonical operator topology ADR and ownership are linked.
• Environment matrix covers local/preview/staging/production.
• Proxy deployment declares IBEX_ENV explicitly and provisions healthy shared REDIS_URL outside local development; Redis outage returns 503 before provider work.
• Operator runtime transcript proves login, API, SSE reconnect/resume, and drain.
• Provider streaming and operator SSE contracts are tested separately.
• services/dashboard/ is labeled compatibility-only with a retirement condition.
• Rollback to a prior evidence-backed console artifact/digest or operator-origin disablement is demonstrated; public docs remain independently available.