feat(self-operated): expose private runtime configuration snapshots

integration-service/src/main/resources/openapi/lingxing-wms-v1.yaml

@@ -6,16 +6,17 @@ info:
     Single-page or single-order adapter. No scheduling, business persistence or public Gateway route.
     Source times remain uninterpreted strings; warehouse timeZone does not certify source timezone.
     Server-side collection mode defaults to OFF. VALIDATION requires an externally confirmed exclusive
-    account window; BUSINESS requires environmentLabel exactly production or test. TEST business task creation is restricted by Lastleg to controlled manual commands and their legitimate derived work; the adapter does not schedule work. All five endpoints apply the same gate.
+    account window; BUSINESS requires environmentLabel exactly production or test. TEST business task creation is restricted by Lastleg to controlled commands and their legitimate derived work; the adapter does not schedule work. Provider-query endpoints apply the same gate.
     Missing exclusive proof, persistent account budget authorization or control context fails closed before egress.
-    At most one account request is in flight and HTTP request starts are separated by at least 5 seconds.
+    At most one account request is in flight; request starts obey the bound minStartInterval (VALIDATION at least 5 seconds).
     A JVM lock is only local protection and is not proof of cross-environment account exclusivity.
     Each invocation performs at most one supplier HTTP attempt. No mode uses implicit HTTP retries;
     429 is never retried, immediately pauses the account and returns persistent cooldown metadata.
     VALIDATION page size must not exceed 10. Lastleg owns root/session budgets and cooldown persistence.
-    External server configuration supplies externalExclusiveGrantId and externalExclusiveUntil;
-    the grant must match context.exclusiveGrantId and remain valid. A BUSINESS rate-limit pause is
-    recoverable only within the original valid exclusive window, after both the persistently returned
+    External server configuration supplies externalExclusiveGrantId and a VALIDATION externalExclusiveUntil;
+    the nonempty grant must match context.exclusiveGrantId. BUSINESS has no grant, session or root time cutoff;
+    explicit stops, persistent account protections and each short single-attempt permit remain enforced.
+    A BUSINESS rate-limit pause is recoverable after both the persistently returned
     cooldown and the local minimum fallback cooldown have elapsed, and after the authority issues a new
     strictly valid single-attempt permit confirming account budget, cooldown, stop limits and root state.
     Time alone never permits egress. VALIDATION 429 does not automatically recover. Unavailable, lost
@@ -32,7 +33,7 @@ x-lastleg-egress-coordination:
     requestHash and atomically consumes persistent account/root/session budget. Duplicate authorization
     is refused; arbitrary client-created attempts are refused. complete verifies the same bindings.
     A permit is bound to its full context, operation and requestHash, requires exclusiveConfirmed=true
-    and budgetConsumed=true, expires after now but no later than now plus 30 seconds or externalExclusiveUntil,
+    and budgetConsumed=true, expires after now but no later than now plus 30 seconds (also within externalExclusiveUntil for VALIDATION),
     and cannot be reused. Explicit denial uses HTTP 200 with ApiResponse code string B0001 and
     AuthorizationDenial data. A valid denial is not an uncertain authorization and does not impose
     a permanent local pause. Unavailable, lost or malformed authorization or an unconfirmed callback blocks further egress;
@@ -50,6 +51,26 @@ x-lastleg-egress-coordination:
 security:
   - InternalServiceToken: []
 paths:
+  /internal/integrations/lingxing/wms/egress/runtime:
+    get:
+      operationId: lingxingEgressRuntime
+      summary: Read sanitized configuration from the active egress gate
+      description: >-
+        Internal token authentication only. No provider, database, budget-authority, permit or persistence side effect.
+        Returns actual bound configuration, not a verified claim or a commit identity. Fingerprints use lowercase
+        SHA-256 of UTF-8 "selfop-runtime:v1:<domain>\n" plus the exact original nonblank value, without trimming.
+        Domains are source-account, grant and budget-authority. Missing/blank values yield null, never an empty-value hash.
+      security: [{InternalServiceToken: []}]
+      responses:
+        '200':
+          description: ApiResponse code 200 with runtime snapshot, or A0401 for missing/invalid internal token
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  data: {$ref: '#/components/schemas/EgressRuntimeSnapshot'}
   /internal/integrations/lingxing/wms/warehouses/query:
     post:
       summary: Query one page of normal warehouses
@@ -154,6 +175,26 @@ components:
       in: header
       name: X-Internal-Service-Token
   schemas:
+    EgressRuntimeSnapshot:
+      type: object
+      additionalProperties: false
+      required: [schemaVersion, service, observedAt, mode, environment, continuousEnabled, grantPresent, intervalMs, permitMaxSeconds, providerEnabled]
+      properties:
+        schemaVersion: {type: integer, enum: [1]}
+        service: {type: string, enum: [integration]}
+        observedAt: {type: string, format: date-time}
+        mode: {type: string, enum: [OFF, VALIDATION, BUSINESS]}
+        environment: {type: string}
+        continuousEnabled: {type: boolean}
+        sourceAccountFingerprint: {type: string, nullable: true, pattern: '^[a-f0-9]{64}$'}
+        grantPresent: {type: boolean}
+        grantFingerprint: {type: string, nullable: true, pattern: '^[a-f0-9]{64}$'}
+        intervalMs:
+          oneOf: [{type: integer, format: int64}, {type: string, pattern: '^[0-9]+$'}]
+          description: Actual bound interval; shared long-value JSON serialization may encode it as a decimal string.
+        permitMaxSeconds: {type: integer, enum: [30]}
+        providerEnabled: {type: boolean}
+        budgetAuthorityFingerprint: {type: string, nullable: true, pattern: '^[a-f0-9]{64}$'}
     EgressContext:
       type: object
       additionalProperties: false