Verified at b4543b4.
docs/wire-contract-v1.md is the consumer-facing integration contract — it names AFT and MC as its audience and says "on any disagreement, the e2e tests win and this doc gets fixed". It is a self-declared "SNAPSHOT of the additive v1.1 surface as of 2026-07-10". The served surface has grown since; the doc has not.
Method
Authoritative op list from management_operations() in crates/synapse-module/src/lib.rs (32 entries, the Vec<ManagementOperation> handed to ProviderRole::ManagementSurface), each name checked against the doc text.
Result: 16 present, 16 absent
Absent (16):
| Op |
Group |
owned_decode.admit_session |
owned-decode session lifecycle |
owned_decode.decode |
" |
owned_decode.snapshot |
" |
owned_decode.continue |
" |
owned_decode.abort |
" |
owned_decode.close |
" |
owned_decode.session_status |
" |
owned_decode.disable |
" |
owned_decode.revoke |
" |
approvals.migrate_owned_decode |
approval / rollback |
approvals.enable |
" |
approvals.disable |
" |
approvals.emergency_rollback |
" |
model.unload |
model lifecycle |
alias.declare |
alias admin |
alias.retract |
" |
Present (16): embed.query, embed.batch, embed.result, job.resume, rerank.score, microllm.oneshot, model.load, model.status, models.list, probe.start, probe.status, probe.report, aliases.check_index, cache.pin, cache.gc, admission.status.
(The single textual owned_decode hit in the doc is at line 304 — prose in the grammar-refusal changelog describing underlying_owned_decode_refusal_id, not an operation entry.)
Why this matters more than a normal doc gap
The absent set is not a random tail — it is the entire owned-decode lane plus the entire approval/rollback surface. Those are the two areas ARCHITECTURE.md treats as the production-grade path, and the approval ops are the ones with real operational consequence (emergency_rollback revokes serving approvals across all lanes in one transaction).
The doc's own precedence clause makes this self-correcting in principle — the e2e tests win — but a consumer integrating from the doc has no signal that half the surface exists. The stale side is also actively misleading in one place: microllm.oneshot is documented in full while the owned-decode ops that supersede it for constrained work are absent entirely.
Suggested fix
Either regenerate the Ops section from management_operations(), or add an explicit coverage note naming which groups the snapshot deliberately excludes and where the current list lives.
A cheap durable guard, if you want one: a test asserting every name in management_operations() appears in docs/wire-contract-v1.md. That converts this from a recurring drift into a red test the next time an op is added. I'd suggest asserting presence only — not shape — so it stays a coverage gate rather than a second contract to maintain.
Note on scope: I have deliberately not filed anything from AUDIT.md — those findings are yours, already committed with reproductions, and re-filing them here would just duplicate your own work onto the board. Say the word if you'd like them tracked as issues and I'll transcribe them faithfully.
Verified at
b4543b4.docs/wire-contract-v1.mdis the consumer-facing integration contract — it names AFT and MC as its audience and says "on any disagreement, the e2e tests win and this doc gets fixed". It is a self-declared "SNAPSHOT of the additive v1.1 surface as of 2026-07-10". The served surface has grown since; the doc has not.Method
Authoritative op list from
management_operations()incrates/synapse-module/src/lib.rs(32 entries, theVec<ManagementOperation>handed toProviderRole::ManagementSurface), each name checked against the doc text.Result: 16 present, 16 absent
Absent (16):
owned_decode.admit_sessionowned_decode.decodeowned_decode.snapshotowned_decode.continueowned_decode.abortowned_decode.closeowned_decode.session_statusowned_decode.disableowned_decode.revokeapprovals.migrate_owned_decodeapprovals.enableapprovals.disableapprovals.emergency_rollbackmodel.unloadalias.declarealias.retractPresent (16):
embed.query,embed.batch,embed.result,job.resume,rerank.score,microllm.oneshot,model.load,model.status,models.list,probe.start,probe.status,probe.report,aliases.check_index,cache.pin,cache.gc,admission.status.(The single textual
owned_decodehit in the doc is at line 304 — prose in the grammar-refusal changelog describingunderlying_owned_decode_refusal_id, not an operation entry.)Why this matters more than a normal doc gap
The absent set is not a random tail — it is the entire owned-decode lane plus the entire approval/rollback surface. Those are the two areas
ARCHITECTURE.mdtreats as the production-grade path, and the approval ops are the ones with real operational consequence (emergency_rollbackrevokes serving approvals across all lanes in one transaction).The doc's own precedence clause makes this self-correcting in principle — the e2e tests win — but a consumer integrating from the doc has no signal that half the surface exists. The stale side is also actively misleading in one place:
microllm.oneshotis documented in full while the owned-decode ops that supersede it for constrained work are absent entirely.Suggested fix
Either regenerate the Ops section from
management_operations(), or add an explicit coverage note naming which groups the snapshot deliberately excludes and where the current list lives.A cheap durable guard, if you want one: a test asserting every name in
management_operations()appears indocs/wire-contract-v1.md. That converts this from a recurring drift into a red test the next time an op is added. I'd suggest asserting presence only — not shape — so it stays a coverage gate rather than a second contract to maintain.Note on scope: I have deliberately not filed anything from
AUDIT.md— those findings are yours, already committed with reproductions, and re-filing them here would just duplicate your own work onto the board. Say the word if you'd like them tracked as issues and I'll transcribe them faithfully.