Add mermaid diagrams for UCs

  10. FM strips topology details (internal IPs, cluster names, namespace names, pod UIDs, node names, internal trace IDs) from the result.

  11. FM returns sanitized EWBI response to partner.

```mermaid

sequenceDiagram

    participant P as Partner OP

    participant F as FM

    participant D as fm_db

    participant S as SRM

    participant B as DataBus

    P->>F: InstallApp + Bearer JWT

    F->>F: Validate JWT and federation agreement

    F->>S: Capacity check

    S-->>F: Best-effort capacity result

    F->>D: Store pending transaction

    F->>B: command.srm.service.deploy

    B->>S: Deliver deploy command

    S->>B: event.srm.operation.completed

    B->>F: Deliver completion event

    F->>D: Finalize transaction

    F-->>P: Sanitized EWBI result

```

### UC-FM-02: Outbound Federation Routing (Our App Provider → Partner Infrastructure)

**Scope (ADR-0044):** this use case covers subscriber-identifier-based routing (MSISDN/IP) for

  6. Partner OP returns the result.

  7. FM passes the result back to OEG (partner responses are already topology-scoped to that OP; FM does not re-expose our internal topology).

```mermaid

sequenceDiagram

    participant A as App Provider

    participant O as OEG

    participant F as FM

    participant D as fm_db

    participant AS as Partner Authorization Server

    participant P as Partner FM

    A->>O: Device Location or Device Status request

    O->>F: Internal forwarding request

    F->>D: Resolve routing rule and agreement

    F->>AS: Client Credentials, fed-mgmt

    AS-->>F: Access token

    F->>P: OPG.04 APIForwarding + Bearer token

    P-->>F: Service API result

    F-->>O: Partner result

    O-->>A: API response

```

### UC-FM-03: Resource Catalogue Synchronization

FM exchanges edge zone and capability availability data with partner operators, enabling both sides to know what resources are available for federated deployment.

  4. FM stores partner-issued OPG.04 `zoneId` values as opaque strings and maps locally issued zone IDs explicitly to SRM `zone.id` UUIDs; it never assumes every partner ID is a UUID.

  5. FM stores synchronized zone/capability data in `shared_resource_catalogues` with directed federation context and ownership.

```mermaid

sequenceDiagram

    participant S as SRM

    participant B as DataBus

    participant F as FM

    participant D as fm_db

    participant P as Partner FM

    S->>B: event.srm.catalog.updated

    B->>F: Catalogue-change event

    F->>S: GET /internal/zones

    S-->>F: Local zones and capabilities

    F->>F: Apply agreement filters and zone-ID mapping

    F->>P: ZoneSubscribe or ZoneUnsubscribe

    P-->>F: Partner zone data or status

    F->>D: Update shared_resource_catalogues

```

### UC-FM-04: Inbound Federated Network Capability Request

A partner operator requests a network capability (e.g., QoS session) for a subscriber that is on our network.

  6. SRM publishes `event.srm.operation.completed`.

  7. FM topology-strips the result and returns to partner.

```mermaid

sequenceDiagram

    participant P as Partner OP

    participant F as FM

    participant D as fm_db

    participant B as DataBus

    participant S as SRM

    P->>F: APIForwarding capability request + JWT

    F->>F: Validate JWT and agreement

    F->>D: Store pending transaction

    F->>B: command.srm.capability

    B->>S: Deliver capability command

    S->>B: event.srm.operation.completed

    B->>F: Deliver completion event

    F->>D: Finalize transaction

    F-->>P: Sanitized capability result

```

### UC-FM-05: Inbound Federated Synchronous Query (Device Location / Device Status)

A partner operator queries device location or device status for a subscriber that is on our network. Unlike deployment or QoS requests, this follows a synchronous request-response path — no DataBus, no service orders. Audit is still recorded in `federation_transactions` with `operation_id` left null.

  8. FM writes a `federation_transactions` row for audit (`operation_id` null; direction=`inbound`).

  9. FM returns the sanitized result to the partner OP.

```mermaid

sequenceDiagram

    participant P as Partner OP

    participant F as FM

    participant S as SRM

    participant T as TF-SDK / NEF

    participant D as fm_db

    P->>F: Device Location or Device Status + JWT

    F->>F: Validate JWT and agreement

    F->>S: Internal synchronous network query

    S->>T: Network adapter query

    T-->>S: Network result

    S-->>F: Query result

    F->>D: Store inbound audit transaction

    F-->>P: Sanitized result

```

### UC-FM-06: Partner Operator Lifecycle Management

An operator onboards, updates, or decommissions a federation partner.

  5. FM uses OPG.04 federation-management operations (`CreateFederation`, `GetFederationHealth`, `RenewFederation`) with the partner.

  6. Subsequent read/update/decommission operations on an existing partner use FM's L.2 internal admin API directly (unchanged by ADR-0043).

```mermaid

sequenceDiagram

    participant O as Operator or Bootstrap

    participant G as OEG

    participant F as FM

    participant D as fm_db

    participant P as Partner FM

    alt OEG-triggered onboarding

        O->>G: Federation establishment request

        G->>F: command.fm.federation.create

    else Bootstrap onboarding

        O->>F: Startup bootstrap configuration

    end

    F->>D: Store partner profile and agreement

    F->>D: Populate routing rules

    F->>P: CreateFederation / GetFederationHealth / RenewFederation

    P-->>F: Federation-management response

    F->>D: Update partner lifecycle state

```

### UC-FM-07: Outbound Federated Deployment via SRM (ADR-0044)

A locally connected App Provider deploys to an Edge Cloud Zone that turns out to be on a partner network. SRM — not OEG — detects this and hands off to FM.

- **Why this exists:** Keeps placement (local-vs-federated) a single SRM-owned decision instead of splitting it between OEG and FM; see ADR-0044.

- **Interim status:** this SRM-side hand-off is a deliberate stopgap pending a future "runtime coordinator" component (platform/future-architecture.md §6.1) that will eventually own it.

```mermaid

sequenceDiagram

    participant A as App Provider

    participant O as OEG

    participant B as DataBus

    participant S as SRM

    participant F as FM

    participant D as fm_db

    participant P as Partner FM

    A->>O: Deploy to target zone

    O->>B: command.srm.service.deploy

    B->>S: Deliver deploy command

    S->>F: Query federated zone data

    F->>D: Read shared_resource_catalogues

    D-->>F: Matching partner zone

    F-->>S: Federated zone entry

    S->>F: Internal federated-deploy hand-off

    F->>P: OPG.04 InstallApp

    P-->>F: Partner deployment result

    F-->>S: Hand-off result

    S->>B: event.srm.operation.completed

    B-->>O: Operation completion

    O-->>A: Deployment status

```

---

## E. Scope Definition