# Contracts (Spec 081)

This spec does not introduce a new HTTP API surface.

## Graph Contract Registry

All Microsoft Graph calls must continue to route through `GraphClientInterface` and must be modeled in `config/graph_contracts.php` (per constitution). Spec 081 changes how credentials are sourced (ProviderConnection/ProviderCredential) and how provider-backed operations are gated/recorded; it does not add new Graph endpoints.

## Planned Contract Work (Implementation)

- Verify all Graph calls made by cutover call sites are already represented in `config/graph_contracts.php`.
- If any missing endpoints are discovered while removing legacy tenant-credential reads, add them to the contract registry as part of the implementation PR(s).
- Add/adjust automated coverage so Spec 081 refactors fail tests if Graph call sites bypass or drift from the contract registry.