Evidence Toolkit: Build Identity + Load-Shed Gate Closers

2026-05-22

apisdkmcpload-sheddingoperations

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: ["GET /v1/ops/build", "GET /v1/ops/status"] sdk_methods_updated: ["client.ops.getBuild()", "client.ops.get_build()"] mcp_tools_updated: ["br_get_ops_build"] ---

What We Built

We converted the strict load-shedding assessment from an unclosed review protocol into a runnable evidence toolkit. The authenticated GET /v1/ops/build endpoint now returns runtime commit SHA, build timestamp, image digest, deploy identity, and Node version, so live probes can prove which image is actually serving traffic before scoring production behavior.

The load-shed path also gained repo-level and operator-level evidence artifacts: mocked multi-tenant isolation, a real-Redis concurrency test harness, production burst scripts, CloudWatch alarm verification, Redis chaos prechecks, and CloudWatch metric-math verification.

Why It Matters

The previous protocol correctly refused to call production verified without runtime identity and live evidence, but it left operators with manual work. This change gives reviewers exact commands with pass/fail outputs, separating repo-only proof from operator-only production proof.

How It Works

/v1/ops/build is a small authenticated capability backed by getOpsBuildIdentity(). SDKs and MCP expose the same payload through ops.getBuild(), ops.get_build(), and br_get_ops_build.

The load-shed publisher now emits per-interval deltas and RedisAdmissionLatencyMsP99, while /v1/ops/status.capacity exposes streaming capacity and Redis admission p99. Tests pin both surfaces.

The Numbers

1 authenticated runtime identity endpoint added.
1 MCP tool added, bringing the generated manifest to 112 tools.
4 focused repo-only tests pass in this sandbox.
4 operator scripts/runbooks produce explicit pass/fail outputs for AWS, Redis, and live tenant evidence.

Competitive Edge

Most gateway claims stop at load-test prose or dashboard screenshots. This toolkit makes the verification path executable: commit identity, tenant isolation, Redis contention, alarm configuration, chaos response, and metric math are all tied to commands a reviewer can rerun.

Lockstep Checklist

[x] API Routes: GET /v1/ops/build added through the capability registry, not src/api/routes/.
[x] TS SDK: packages/sdk-ts exposes client.ops.getBuild() and the OpsBuild type.
[x] Python SDK: packages/sdk-py exposes sync and async get_build() methods.
[x] MCP Schemas: br_get_ops_build added to MCP handlers, manifest, standalone MCP CLI, and generated agents.json.
[x] Master Record: No checked-in docs/architecture/master-capability-record.md exists in this hard-fork checkout; lockstep is recorded in this ship log and .claude/notes/codex-evidence-gathering-toolkit.md.