V2-BE-084 — Make OpenAPI the Tested Public Contract

[dDevAhmed]

Objective

Make OpenAPI the Tested Public Contract as a focused, independently reviewable V2 backend work item.

Technical Scope

Generate and validate OpenAPI from runtime definitions, add examples/error models, and block undocumented breaking changes.

Security and Architecture Requirements

• The API may index, validate, cache, and relay user-signed intent; it must never become authoritative for protocol settlement, rewards, treasury, or governance.
• Preserve Optimism/EVM semantics and reject Stellar, Soroban, or Freighter runtime dependencies.
• Use Prisma as the canonical persistence layer; do not deepen TypeORM/dual persistence.
• Do not commit secrets, personal data, generated drift, or placeholder production configuration.

Required Tests

• Unit tests for success, boundary, authorization, and failure paths.
• Integration tests against real PostgreSQL/Redis or deterministic service containers where applicable.
• Regression tests for retry, concurrency, replay, restart, and degraded dependencies.
• Run all required lint, typecheck, security, build, migration, and artifact checks.

Acceptance Criteria

• Scope is delivered without unrelated protocol or UI changes.
• Failure modes are bounded, observable, redacted, and fail closed.
• Concurrency and idempotency behaviour is explicitly tested.
• API/OpenAPI/runbook documentation is updated where applicable.
• The PR maps evidence to every acceptance criterion.
• Human maintainer approval is recorded for auth, database, indexer, or other sensitive changes.

Dependencies

• V2-BE-070

Non-Goals

• Signing transactions for users.
• Calculating authoritative verdicts, settlement, rewards, or reputation.
• Restoring legacy dual-persistence architecture.

---

🏷 Labels

• backend
• security
• complexity-medium
• wave-candidate
• devops

---