Module routes 

Noun-based HTTP route modules.

Modules

deferrals 🔒

GET /v1/deferrals - currently-blocked (rollout, host) pairs as observed by the latest gate decisions in event_log.

dispatch 🔒

GET /v1/agent/dispatch?wait=60 — long-poll dispatch delivery.

enrollment 🔒

Cert-issuance handlers for enroll and renew.

events 🔒

POST /v1/agent/events — inbound event ingestion (RFC-0005 §4.2).

fleet 🔒

Stateless distributor for the signed fleet.resolved.json artifact.

health 🔒

GET /healthz - outside /v1/* so it bypasses the protocol-version middleware.

heartbeat 🔒

POST /v1/agent/heartbeat — agent liveness + drift detection (RFC-0005 §4.3). Replaces the v0.1 POST /v1/agent/checkin flow.

metrics 🔒

/metrics - Prometheus text format. mTLS-protected like /v1/*; operator Prometheus scrapes with the same agent identity it presents to /v1/hosts. Returns 404 when the metrics feature is off.

rollouts 🔒

Stateless distributor for pre-signed rollout manifests; CP holds no signing key.

status 🔒

Read-only status endpoints and closure proxy fallback.