Update bc GSMA forbids dasshes

| `external_txn_id` | VARCHAR(255) | | OPG.04 transaction identifier both operators hold when the operation defines one (`txnIdentifier` / `apiTxnId`); NULL otherwise |

| `idempotency_key` | VARCHAR(255) | | Required OPG.04 `Idempotency-Key` where the operation declares it |

| `request_fingerprint` | CHAR(64) | | SHA-256 of canonical request data; detects idempotency-key reuse with different content |

| `external_resource_id` | VARCHAR(255) | | Contract-defined external identifier, such as `appInstIdentifier` |

| `external_resource_id` | VARCHAR(255) | | Contract-defined external identifier, such as `appInstIdentifier`; stored in its wire spelling (hex for `InstanceIdentifier`, which forbids hyphens) |

| `api_type` | VARCHAR(100) | NOT NULL | Internal normalized operation key, e.g. `install-app`, `device-location` |

| `status` | VARCHAR(20) | NOT NULL, DEFAULT 'pending' | Internal lowercase audit state: `pending`, `in_progress`, `completed`, `partially_completed`, `failed` |

| `request_summary` | JSONB | NOT NULL | Sanitized request metadata |

| 2.1-draft | 2026-09-08 | Align entities, context routing, transaction audit fields, ADR references, and DataBus roles with current FM architecture. |

| 2.1-draft | 2026-09-08 | Dropped `X-Federation-Correlation-ID`; `federation_correlation_id` replaced by `external_txn_id`. |

| 2.1-draft | 2026-09-08 | `federation_contexts` landed in code; status vocabulary enumerated from the OPG.04 `Status` enum. |

| 2.1-draft | 2026-09-08 | `external_resource_id` records the wire spelling of the external identifier; LCM audit columns (idempotency key, request fingerprint, callback) landed in code. |

| `external_txn_id` | VARCHAR(255) | | OPG.04 transaction identifier both operators hold when the operation defines one (`txnIdentifier` / `apiTxnId`); the cross-operator dispute-lookup key. NULL for operations without one |

| `idempotency_key` | VARCHAR(255) | | Required OPG.04 `Idempotency-Key` for operations that declare it |

| `request_fingerprint` | CHAR(64) | | SHA-256 of canonical request data; rejects reuse of an idempotency key with a different request |

| `external_resource_id` | VARCHAR(255) | | Contract-defined external identifier such as `appInstIdentifier` |

| `external_resource_id` | VARCHAR(255) | | Contract-defined external identifier such as `appInstIdentifier`, stored in the wire spelling (hex for `InstanceIdentifier`, which forbids hyphens — see L.1) |

| `api_type` | VARCHAR(100) | NOT NULL | Internal normalized operation key, e.g. `install-app`, `device-location` |

| `status` | VARCHAR(20) | NOT NULL, DEFAULT 'pending' | Internal lowercase audit state: `pending`, `in_progress`, `completed`, `partially_completed`, `failed`. Each OPG.04 operation maps this to its contract-specific response or callback state; there is no universal EWBI status schema. |

| `request_summary` | JSONB | NOT NULL | Sanitized request metadata (no PII beyond what's needed for audit) |

`InstallApp` requires `Idempotency-Key` plus `appId`, `appProviderId`, `appVersion`, `zoneInfo`, and

`appInstCallbackLink`, and returns `202` with `zoneId` and `appInstIdentifier`.

**Identifier forms at the InstallApp boundary.** Two OPG.04 identifier patterns constrain how FM

maps its internal UUIDs onto the wire:

- `InstanceIdentifier` is `^[A-Za-z0-9][A-Za-z0-9_]{6,62}[A-Za-z0-9]$`, which permits underscores

  but **not** hyphens, so a canonical dashed UUID is not a legal `appInstIdentifier`. FM mints the

  app instance identity as a UUID (`targets[].app_instance_id` on `command.srm.service.deploy`,

  ADR-0005) and returns its 32-character hex form over EWBI. The hex form is what

  `federation_transactions.external_resource_id` stores; the two are the same value in different

  spellings, and FM converts at the boundary rather than minting a second identity.

- `ZoneIdentifier` is `^[A-Za-z0-9][A-Za-z0-9-]*$`, which does permit a dashed UUID. Per ADR-0017

  the EWBI zone identity *is* SRM's `zone.id` UUID passed through unchanged, so FM parses

  `zoneInfo.zoneId` as a UUID and rejects a value that is not one with an `agreement-violation`

  error: an unparseable zone can never appear in the agreement's `permitted_zone_ids`.

`APIForwarding` is not a transparent raw-body tunnel. FM constructs and validates the OPG.04

wrapper (`apiServiceId`, `customerID`, `customerInfo`, `txnIdentifier`, `ServiceAPIBody`, optional

`eventNotificationDest`), forwards that wrapper, validates `serviceAPIResponse`, preserves its

| 2.0 | 2026-09-04 | REQ-FED-19 narrowed for partner profiles/agreements only (routing rules explicitly unaffected — out of ADR-0043's scope); added REQ-FED-20/21 for OEG-proxied federation establishment (ADR-0043) and SRM-forwarded federated deploys (ADR-0044). Added L.3a and `command.fm.federation.*` to K.2; L.3 scoped to subscriber-identifier routing only. |

| 2.0 | 2026-09-08 | Dropped the `X-Federation-Correlation-ID` extension: OPG.04 v1.4.0 defines no correlation header and a partner never stores or echoes it. REQ-FED-10 reworded; `federation_transactions.federation_correlation_id` replaced by `external_txn_id` (OPG.04 `txnIdentifier`/`apiTxnId`). |

| 2.0 | 2026-09-08 | Enumerated `federation_contexts.status`: OPG.04 `Status` values plus `terminated`; establishment is synchronous so there is no pending state. |

| 2.0 | 2026-09-08 | L.1: recorded the InstallApp identifier forms — `appInstIdentifier` is the app-instance UUID in hex because `InstanceIdentifier` forbids hyphens; `zoneInfo.zoneId` is parsed as SRM's zone UUID (ADR-0017) and a non-UUID is an agreement violation. |