openapi: 3.0.3
info:
  title: TenantPilot Admin - Managed Environment Core Cutover (Conceptual)
  version: 0.1.0
  description: |
    Conceptual contract for the first workspace-first / managed-environment
    cutover slice.

    NOTE: This package is intentionally narrower than the full route and IA
    rewrite. The current public `/admin/t/{environment}` shell is retained as a
    documented temporary exception only while the bound model changes from
    `Tenant` to `ManagedEnvironment`.
paths:
  /choose-environment:
    servers:
      - url: /admin
    get:
      summary: Choose the active managed environment for the current workspace
      description: |
        The chooser is available only after workspace context is established.
        It replaces the current tenant chooser with a managed-environment
        selection surface.
      responses:
        '200':
          description: Managed-environment chooser rendered
          content:
            text/html:
              schema:
                type: string
          x-logical-view-model:
            $ref: '#/components/schemas/ManagedEnvironmentChooserView'
        '404':
          $ref: '#/components/responses/NotFound'
  /t/{environment}:
    servers:
      - url: /admin
    get:
      summary: Enter the current environment-scoped panel shell
      description: |
        This is the temporary public shell retained by Spec 279 only.
        The route parameter now resolves a `ManagedEnvironment` instead of a
        `Tenant`. Spec 280 owns the later public route-family rewrite.
      parameters:
        - $ref: '#/components/parameters/ManagedEnvironmentSlug'
      responses:
        '200':
          description: Environment-scoped shell rendered
          content:
            text/html:
              schema:
                type: string
          x-logical-view-model:
            $ref: '#/components/schemas/ManagedEnvironmentContextShell'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      x-capability-rules:
        workspace_membership: required
        managed_environment_membership: required
components:
  parameters:
    ManagedEnvironmentSlug:
      name: environment
      in: path
      required: true
      schema:
        type: string
  responses:
    Forbidden:
      description: Actor is in scope but lacks the required capability on the managed environment
    NotFound:
      description: Wrong workspace, wrong managed environment, or non-member access is hidden as not found
  schemas:
    ManagedEnvironmentChooserView:
      type: object
      required:
        - workspace
        - environments
      properties:
        workspace:
          $ref: '#/components/schemas/WorkspaceSummary'
        environments:
          type: array
          items:
            $ref: '#/components/schemas/ManagedEnvironmentSummary'
    ManagedEnvironmentContextShell:
      type: object
      required:
        - workspace
        - managed_environment
        - exception_note
      properties:
        workspace:
          $ref: '#/components/schemas/WorkspaceSummary'
        managed_environment:
          $ref: '#/components/schemas/ManagedEnvironmentSummary'
        exception_note:
          type: string
          example: Temporary /admin/t shell retained by Spec 279 only; closed by Spec 280.
    WorkspaceSummary:
      type: object
      required: [id, name, slug]
      properties:
        id:
          type: integer
        name:
          type: string
        slug:
          type: string
    ManagedEnvironmentSummary:
      type: object
      required: [id, workspace_id, slug, name, kind, lifecycle_status]
      properties:
        id:
          type: integer
        workspace_id:
          type: integer
        slug:
          type: string
        name:
          type: string
        display_name:
          type: string
          nullable: true
        kind:
          type: string
        lifecycle_status:
          type: string