Merge branch 'oeg-fm' into fm-srm-handoff

### Federation Context

One directed OPG.04 federation relationship. For inbound federation, our FM issues the

`federationContextId` — minted during `CreateFederation` handling and returned on that same

synchronous response (inbound EWBI calls arrive directly on EWBI; operator-triggered establishment

arrives via OEG's §L.3b proxy, ADR-0046); for outbound federation, the partner issues it and our

FM stores it. Every

One directed OPG.04 federation relationship. For inbound federation (a partner OP calling

`CreateFederation` on our canonical EWBI prefix), our FM issues the `federationContextId` — minted

during `CreateFederation` handling and returned on that same synchronous response. For outbound

federation (operator-triggered via OEG's §L.3b proxy, ADR-0051, or FM's bootstrap configuration),

the partner issues it and our FM stores it. Every

subsequent canonical OPG.04 path resolves this opaque string before processing. Context direction,

status, agreement, and partner-status callback URL are durable. OEG holds none of this state.

| 2.0 | 2026-09-08 | §L.3b Errors bullet expanded: OEG's own faults on the proxy path (`400`/`401`/`403`/`502`/`503`, incl. the previously undeclared FM-unreachable `503`) use OPG.04 `application/problem+json` `ProblemDetails`, not CAMARA `ErrorInfo` — matches FM's relayed error shape (OEG interface-contract §K.6a, ADR-0050). FM's own EWBI error model (REQ-FED-14, §L.5) is unchanged. |

| 2.0 | 2026-09-08 | ADR-0051 corrects ADR-0046's scope/payload/namespace for the OEG-proxied surface (transport unchanged). §L.3b retitled "Federation-Lifecycle Proxy": now seven canonical OPG.04 operations (create/read/update/delete federation, `GetFederationContextId`, zone subscribe/unsubscribe) served by OEG on `/operatorplatform/federation/v1/*` for the operator-triggered *outbound* direction, with the raw GSMA payload forwarded byte-for-byte (no reshaping, no §L.2 admin shape) and a no-log/no-persist rule for the credential-bearing body. Inbound partner traffic on the same paths still terminates at FM — the two directions split at the ingress. REQ-FED-19/20 and the L.2 note rewritten; priority federation-management table note updated. |

| 2.0 | 2026-09-16 | ADR-0051 amended after FM-side review, reversing this file's own previous entry above: OEG's federation-lifecycle proxy goes back onto its own `/platform/v1/federation/partners/{partnerOpId}/federations/...` namespace, not the canonical OPG.04 prefix — the canonical URL loses partner addressing once there's an OEG hop in front of FM. §L.3b, the priority federation-management table, and REQ-FED-19/20 rewritten: eight operations now (`GetZoneData` added, `UpdateFederation` out of scope), query string forwarded, spec pinned to GSMA OPG.04 v6.0 / artifact v1.4.0, `partnerCallbackCredentials` dropped (not a v1.4.0 field), partner resolution tied to FM's not-yet-built partner registration (federation-manager#20). The "FM authenticates OEG's platform service credential (ADR-0042)" auth claim is corrected everywhere it appeared: this hop has no dedicated credential, only cluster-internal network-policy reachability; ADR-0042 is EWBI partner-facing auth only. ADR-0047/0048 renumbered to ADR-0050/0051. |

| 2.0 | 2026-09-28 | Federation Context entity: operator-triggered establishment (OEG's §L.3b proxy, ADR-0051) and bootstrap moved from the inbound sentence to the outbound one — on outbound the partner issues `federationContextId` and FM stores it; the stale ADR-0046 citation replaced with ADR-0051. |

| 2.0 | 2026-09-29 | §L.3b: FM's status set on the `/internal` federation-lifecycle routes pinned to OPG.04 v1.4.0's declared statuses, with the mapping for FM's EWBI-side `403`/`502` and for partner rejections (REQ-FED-14; OEG §K.6a's `502` gate relies on it). |

| 2.0 | 2026-09-29 | §L.3a: `command.fm.service.terminate` fires on SRM's `hosted_by: partner` instance row (ADR-0053's 2026-09-25 amendment), and FM resolves the instance from the outbound `install-app` transaction, since the partner issues the `appInstIdentifier`. §M.1: new `completion_basis` `partner_not_found` for a `RemoveApp` answered `404`. |

| 2.0 | 2026-09-29 | REQ-FED-21 restored to its ADR-0053 wording (DataBus hand-off, deploy and terminate, outcome on `event.fm.operation.completed`); a conflict resolution when §L.3b's status rule merged in had put back the pre-ADR-0053 text. |

([fm/requirements-and-design.md §L.3b](/fm/requirements-and-design.md)). The endpoints are **OEG's

own platform namespace**, `/platform/v1/federation/partners/{partnerOpId}/federations/...`, **not**

the canonical OPG.04 server paths (ADR-0051's amended decision; its first version had this

backwards). `partnerOpId` is our own registered id for the partner, named explicitly on every

backwards). `partnerOpId` is our own registered id for the partner — the UUID FM assigns at

registration — named explicitly on every

route — GSMA's canonical path gets partner addressing for free from the URL in a direct

operator-to-operator call, but that signal is lost once there is an OEG hop in front of FM, so it

has to be carried explicitly instead:

**Illustrative request**

```http

POST /platform/v1/federation/partners/partner-op-berlin/federations

POST /platform/v1/federation/partners/3c9e1f4a-7b2d-4e8f-9a61-5d0c2b7e8f13/federations

Authorization: Bearer <operator JWT>

Content-Type: application/json

```

}

```

`partner-op-berlin` is our own registered id for the partner, not a raw partner URL —

`partnerOpId` is our own registered id for the partner — the UUID FM assigns when the partner is

registered (REQ-FED-19), not a raw partner URL or a free-form slug; OEG rejects any other format

with a `400` `ProblemDetails` before calling FM —

`partnerCallbackCredentials` no longer exists as a v1.4.0 field, and `initialDate` /

`partnerStatusLink` are the only required ones.

| 2.0 | 2026-09-08 | K.0 gains an explicit note that the inbound EWBI prefix `/operatorplatform/federation/v1/*` is FM's, outside OEG's mount scheme and the `/api/*` rewrite; its public ingress (Nginx → `fm:8082`) is not deployed today, so there is no partner-facing EWBI ingress and inbound federation is a future release. N.7's inbound-EWBI note updated to match. Clarification of ADR-0046 / ADR-0020; no behaviour change. |

| 2.0 | 2026-09-08 | ADR-0051 corrects ADR-0046's scope/payload/namespace (transport kept). N.7 retitled "Federation-Lifecycle Proxy": now the seven canonical OPG.04 operations under `/operatorplatform/federation/v1/*` (create/read/update/delete federation, `GetFederationContextId`, zone subscribe/unsubscribe) for the operator-triggered *outbound* direction — not three under an OEG `/platform/v1/` namespace. Request/response bodies are the raw GSMA schemas (`FederationRequestData` / `FederationResponseData`) forwarded byte-for-byte; OEG does no reshaping and does not log/persist the credential-bearing body. K.0 rewritten to describe the two-component ingress split on the shared prefix; K.6/K.6a repointed to the seven canonical operations. |

| 2.0 | 2026-09-10 | `command.srm.service.deploy` field list no longer includes `federation_partner_ref` — OEG never populated it and, with federation decoupled from OEG (ADR-0051), never will. The field stays in SRM's `CommandEnvelopeV1` (set by FM); a note records that OEG omits it. |

| 2.0 | 2026-09-16 | ADR-0051 amended after FM-side review (its own status now reflects this): N.7 rewritten for OEG's own `/platform/v1/federation/partners/{partnerOpId}/federations/...` namespace, not the canonical OPG.04 prefix — eight operations (`GetZoneData` added), every path scoped by a registered `partnerOpId`, query string forwarded on every call, spec pinned to GSMA OPG.04 v6.0 / artifact v1.4.0 (`partnerCallbackCredentials` removed — not a v1.4.0 field), and the OEG→FM auth step corrected to cluster-internal network-policy reachability only (no dedicated Keycloak client was built; ADR-0042 covers EWBI partner-facing auth, not this hop). K.0 and K.6a updated to match; the two directions no longer share a URL split at the ingress. ADR-0047/0048 renumbered to ADR-0050/0051 to clear a collision with `develop` and `docs/platform-roles`. || 2.0 | 2026-09-29 | §K.6a: "FM's contract" for the `502` row now points at FM RD §L.3b, which pins the status set FM answers with on the federation-lifecycle routes. |

| 2.0 | 2026-09-16 | ADR-0051 amended after FM-side review (its own status now reflects this): N.7 rewritten for OEG's own `/platform/v1/federation/partners/{partnerOpId}/federations/...` namespace, not the canonical OPG.04 prefix — eight operations (`GetZoneData` added), every path scoped by a registered `partnerOpId`, query string forwarded on every call, spec pinned to GSMA OPG.04 v6.0 / artifact v1.4.0 (`partnerCallbackCredentials` removed — not a v1.4.0 field), and the OEG→FM auth step corrected to cluster-internal network-policy reachability only (no dedicated Keycloak client was built; ADR-0042 covers EWBI partner-facing auth, not this hop). K.0 and K.6a updated to match; the two directions no longer share a URL split at the ingress. ADR-0047/0048 renumbered to ADR-0050/0051 to clear a collision with `develop` and `docs/platform-roles`. |

| 2.0 | 2026-09-28 | N.7: `partnerOpId` is the UUID FM assigns when the partner is registered (FM's `/internal` routes accept nothing else); OEG rejects any other format with a `400` `ProblemDetails` before calling FM. Illustrative request's slug replaced with a UUID. |

| 2.0 | 2026-09-29 | §K.6a: "FM's contract" for the `502` row now points at FM RD §L.3b, which pins the status set FM answers with on the federation-lifecycle routes. |