Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Dashboard Web owns an unprivileged operator-facing SPA; all privileged operations require Operator authorization.
- Reverse-proxy route precedence must not accidentally serve an HTML SPA for an operator API route, and host isolation must remain enforced by the intended owner.
Verification still required
- Verify live host/route precedence, browser authentication and protected API responses after approved integration.
- Check actual asset serving and bundle/runtime behavior in desktop/mobile browsers; historical frontend tests do not prove production ingress.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.