update: note inbound EWBI ingress is a future release

| Area | Current architecture position |

|---|---|

| **EWBI termination** | Terminate all inbound EWBI HTTPS requests routed via Nginx under the OPG.04 server prefix `/operatorplatform/federation/v1/*` — no operation is carved out to OEG. Separately, the operator-triggered federation-establishment and lifecycle actions arrive as a synchronous internal HTTP call from OEG (§L.3b; ADR-0046), authenticated by OEG's platform service credential and mapped to OPG.04 by FM. Client mTLS is a future defense-in-depth layer (ADR-0042), not required today. |

| **EWBI termination** | Terminate all inbound EWBI HTTPS requests routed via Nginx under the OPG.04 server prefix `/operatorplatform/federation/v1/*` — no operation is carved out to OEG. That Nginx ingress is not deployed today, so there is no partner-facing EWBI ingress and inbound federation from external partner OPs is not exercised — it is a future release (OEG interface-contract §K.0). Separately, the operator-triggered federation-establishment and lifecycle actions arrive as a synchronous internal HTTP call from OEG (§L.3b; ADR-0046), authenticated by OEG's platform service credential and mapped to OPG.04 by FM — this path works today and does not depend on Nginx. Client mTLS is a future defense-in-depth layer (ADR-0042), not required today. |

| **Partner authentication** | OAuth2 Client-Credentials + signed JWT. Our Keycloak `federation` realm issues inbound tokens; each target partner's Authorization Server issues outbound tokens. FM validates `fed-mgmt` and maps inbound `azp` to the partner profile (ADR-0042). |

| **Federation agreement enforcement** | Check that the requesting partner has a valid agreement before routing any request. |

| **Outbound federation routing** | Resolve target partner from user identifiers (MSISDN — Mobile Station International Subscriber Directory Number — prefix, IP CIDR — Classless Inter-Domain Routing block) via routing table. Forward requests over EWBI to partner OPs. |

| 2.0 | 2026-07-07 | OOP Release 2.0. |

| 2.0 | 2026-09-04 | Added OEG-proxied federation-establishment trigger and FM bootstrap config (ADR-0043, UC-FM-06 updated). Added UC-FM-07: SRM (not OEG) now owns zone-based deployment locality and the hand-off to FM (ADR-0044); UC-FM-02/G3 narrowed to subscriber-identifier routing; added G4 for the open SRM→FM transport question. |

| 2.0 | 2026-09-08 | OEG→FM transport for the *operator-triggered* federation-establishment trigger moves from async over the DataBus (ADR-0043) to a synchronous internal HTTP call (ADR-0046); scope, the operator endpoint and its payload are unchanged from ADR-0043. FM authenticates OEG's platform service credential and maps the operator payload to OPG.04; FM mints `federationContextId` and replies on the same call. Inbound EWBI termination is unchanged — the whole `/operatorplatform/federation/v1/*` prefix stays with FM, no OEG carve-out. UC-FM-06, boundaries and boundary matrix updated; `command.fm.federation.*` consumer row replaced. |

| 2.0 | 2026-09-08 | A.1 EWBI-termination row notes the Nginx EWBI ingress is not deployed today, so there is no partner-facing inbound EWBI ingress and inbound federation is a future release; the operator-triggered OEG→FM internal path (§L.3b) works today regardless. Clarification, no behaviour change. |

paths are the implementation truth — see [oeg/architecture.md](/oeg/architecture.md) H.1 and

[oeg/persistence-model.md](/oeg/persistence-model.md).

**Inbound EWBI is outside this scheme.** The OPG.04 prefix `/operatorplatform/federation/v1/*` is

**FM's**, not an OEG API family — it is never mounted on OEG and never passes through the `/api/*`

ingress rewrite. Its public ingress is Nginx terminating TLS and routing the whole prefix straight

to FM (`fm:8082`); Nginx is not deployed today, so there is no partner-facing EWBI ingress and

inbound federation from external partner OPs is a future release (ADR-0046). The operator-triggered

*outbound* federation trigger (§N.7) is unaffected — it is an ordinary OEG route under

`/platform/v1/federation/*`, reachable on `OEG:8080` today like any other `/platform/v1/` endpoint.

### K.1 External NBI example - async deploy (single zone)

Per the vendored CAMARA EAM spec, `POST /appinstances` targets **one** zone (`edgeCloudZoneId` is

directly (`CreateFederation`, `InstallApp` and application LCM, `APIForwarding`, `GetFederationHealth`,

`RenewFederation`, `GetPlatformCapabilities`, `GetFederationAPIs`, …) are routed by Nginx straight

to FM and never reach OEG — no path split. FM validates the partner `fed-mgmt` token and runs OPG.04

for those (fm/requirements-and-design.md §L, REQ-FED-01).

for those (fm/requirements-and-design.md §L, REQ-FED-01). Nginx is not deployed today, so there is

no partner-facing EWBI ingress and inbound federation is a future release (§K.0). The operator

trigger described here is unaffected — it is an OEG `/platform/v1/` route available now.

**What happens**

| 2.0 | 2026-09-04 | N.5 split by target type: zone-based deployment locality moves entirely to SRM (ADR-0044), no federation branch remains in OEG's deploy flow. Added N.7 for the OEG-proxied federation-establishment trigger (ADR-0043). |

| 2.0 | 2026-09-08 | N.7 transport updated for ADR-0046: the OEG→FM hop is a synchronous internal HTTP call instead of async `command.fm.federation.*` — no `operations` row, no `202`, no completion callback; FM mints `federationContextId` and returns it on the same call. Scope, the operator-facing endpoint (`POST /platform/v1/federation/partners`) and its payload are unchanged from ADR-0043; inbound EWBI stays entirely with FM (no Nginx path split). FM authenticates the OEG→FM call via a platform service credential (ADR-0042); OEG forwards no `partner_op_id`. |

| 2.0 | 2026-09-08 | K.6 scoped to OEG's CAMARA northbound surface and given an explicit exception; added K.6a — the §N.7 federation-lifecycle proxy endpoints return OPG.04 `application/problem+json` `ProblemDetails` for every error (relayed FM errors byte-for-byte; OEG-originated `400`/`401`/`403`/`502`/`503` from a fixed template, incl. the previously undeclared FM-unreachable `503`), never CAMARA `ErrorInfo`. N.7 step 1 and a new N.7 Errors block point at K.6a. ADR-0047. |

| 2.0 | 2026-09-08 | K.0 gains an explicit note that the inbound EWBI prefix `/operatorplatform/federation/v1/*` is FM's, outside OEG's mount scheme and the `/api/*` rewrite; its public ingress (Nginx → `fm:8082`) is not deployed today, so there is no partner-facing EWBI ingress and inbound federation is a future release. N.7's inbound-EWBI note updated to match. Clarification of ADR-0046 / ADR-0020; no behaviour change. |

 No newline at end of file