title: API (production): sprint 2 design (1–14 Nov 2026) component: API level: iteration status: draft 1 (27 Oct) owner: MMDEP Design (Claude) phase: api/phase-1.md (streams A–E for S2)
API: sprint 2¶
Sprint goal: write routes log every unkeyed call on staging and production; the NAV audit tells us exactly what is wrong; release 2 (health, category flags, stale connections) reaches production; the ingest contract is written down.
| Queue step | LLD | Design | Build | S2 exit |
|---|---|---|---|---|
| P1 write-route security | LLD-write-route-security.md | Claude (high) | API agent items 1, 2, 4, 7, 8; harness 3, 5, 6, 9 | Inventory done (no unguarded client-data route, or that one fixed); log mode on staging and production; keys issued |
| P2 NAV integrity | LLD-nav-integrity.md | Claude (high) | API agent; a person runs the audit | Audit outputs in MMDEP relay; duplicate types counted |
| P3 release 2 | no LLD: small fixes with tests (/api/health, /category stored flags plus effective menu tree, pool_pre_ping/pool_recycle, NAV socket) |
API agent | API agent, harness | RC MR with evidence and MWMC/MCRM UAT lines; Atul approves |
| P4 fund-factsheet contract | contract document, no LLD | API agent | — | docs/contracts/fund-factsheet.md, accepted by MWMC; fields TER and fund details point at the ingest tables (TD-054, TD-065) |
| P5 ingest routes | LLD-ingest-routes.md | Claude (high) | API agent items 1–2 in S2; build in S3 | OpenAPI entries for the 10 routes |
Order inside the sprint: P1 inventory first (it can reveal a client-data hole) → P3 release (Atul's approval takes days, so start early) → P2 audit (needs a person on the server) → P5 spec → P4 contract.