cursor · Aug 16, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,7 @@ All notable product and architecture changes are recorded here. Releases use imm
 ## Unreleased
 
 ### Added
+- Public `POST /v1/sessions` and `GET /v1/sessions/{session_ref}` mint and reload an in-process assessment session bound to one published locale-specific release, with `Idempotency-Key` replay and RFC 9457 problem details. OpenAPI 3.2 as-built contract is `openapi/sessions.yaml`. Process-restart durability remains a later persist slice.
 - Scoring-job cancel and lease-expiry fallback classification lock the current row until the caller transaction ends, so concurrent workers cannot rewrite terminal or unleased evidence.
 - PostgreSQL operational-store readiness probe classifies the supported major version and write-readiness, and fails closed when a caller-declared required relation is missing.
 - PostgreSQL scoring-job cancellation: queued, leased, or retry-scheduled work becomes cancelled without transferring a fence, exact replay is idempotent, and completed or quarantined evidence cannot be rewritten.

diff --git a/README.md b/README.md
@@ -43,6 +43,7 @@ It does **not** duplicate psychometric numerical kernels, identity credentials,
 - [Security, Privacy, and Data Boundaries](docs/architecture/SECURITY_AND_DATA.md) — trust boundaries, classification, threats, identity, research, and AI data policies.
 - [Deployment, Operations, and Recovery](docs/architecture/DEPLOYMENT_AND_OPERATIONS.md) — deployment profiles, degraded modes, observability, backup/restore, migration, and GA recovery evidence.
 - [Requirements and Architecture Traceability](docs/TRACEABILITY.md) — PRD/TRD/ADR requirements mapped to current protected-main implementation status and future evidence.
+- [Public session OpenAPI](openapi/sessions.yaml) — as-built OpenAPI 3.2 contract for `POST /v1/sessions` and `GET /v1/sessions/{session_ref}` only.
 - [Product Delivery Roadmap](docs/ROADMAP.md) — dependency-ordered implementation phases and evidence-based exit criteria.
 - [Documentation Completeness Assessment](docs/DOCUMENTATION_ASSESSMENT.md) — what is sufficient as an implementation baseline and what still blocks GA operational evidence.
 
@@ -56,4 +57,4 @@ It does **not** duplicate psychometric numerical kernels, identity credentials,
 
 An accepted ADR must define concrete ownership, interfaces, invariants, failure behavior, security/privacy/tenancy boundaries, migration and rollback, validation evidence, alternatives, and reversal conditions. Material implementation that contradicts an accepted ADR requires an explicit superseding decision rather than silent architectural drift.
 
-Architecture diagrams may describe **normative target semantics** that are not yet deployed. A diagram, PRD item, ADR, threat mitigation, runbook, or release checklist is not implementation or operational evidence. [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md) identifies what exists on a named protected-main baseline versus what remains a target. When an HTTP API is implemented, its OpenAPI contract becomes a release requirement. When durable event transport is implemented, its AsyncAPI contract becomes a release requirement. When a physical database migration is implemented, its schema and migration evidence become release requirements. Do not fabricate any of these artifacts before the corresponding implementation exists.
+Architecture diagrams may describe **normative target semantics** that are not yet deployed. A diagram, PRD item, ADR, threat mitigation, runbook, or release checklist is not implementation or operational evidence. [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md) identifies what exists on a named protected-main baseline versus what remains a target. The first implemented public HTTP family is documented by [`openapi/sessions.yaml`](openapi/sessions.yaml). When additional HTTP families are implemented, their OpenAPI operations become a release requirement. When durable event transport is implemented, its AsyncAPI contract becomes a release requirement. When a physical database migration is implemented, its schema and migration evidence become release requirements. Do not fabricate any of these artifacts before the corresponding implementation exists.
diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md
@@ -31,7 +31,7 @@ This reconciliation closes those architecture-definition gaps without promoting
 | Quality / risk / compliance readiness | **Sufficient as assurance baseline** | Evidence scenarios and risk state are explicit; readiness is not certification. |
 | Traceability | **Repaired in this reconciliation** | Baseline now names exact protected-main `748876…`, marks newly merged domain modules Implemented/Partial, and isolates PR #24 as Active PR. Must be updated after every material merge. |
 | Roadmap / agent guidance / changelog | **Sufficient for continued delivery** | Must remain code-current; documentation completion is not a terminal condition for the execution loop. |
-| Machine-readable OpenAPI / AsyncAPI | **Not yet applicable as as-built evidence** | Add and validate with the first implemented HTTP/event transport. Do not publish aspirational operations as deployed. |
+| Machine-readable OpenAPI / AsyncAPI | **Partial / session family only** | `openapi/sessions.yaml` is the as-built contract for `POST /v1/sessions` and `GET /v1/sessions/{session_ref}`. Do not publish remaining TRD families as deployed. AsyncAPI remains not applicable until durable event transport exists. |
 | Physical schema / as-built topology | **Partial / implementation-gated** | Logical ERD is authoritative target semantics. Actual migrations/topology/rollback/restore evidence must be compared to it as those artifacts land. |
 | Instrument-release evidence bundles | **Target** | Every publishable consumer instrument needs immutable rights, locale/translation, scoring/calibration/norm, DIF/invariance/linking where claimed, scoreability, intended-use and narrative-rule evidence. |
 

diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md
@@ -20,7 +20,7 @@ An active PR, architecture document, conversation decision, or scheduler plan is
 
 | Requirement | PRD source | Technical/architecture contract | ADR(s) | Evaluated-main implementation |
 |---|---|---|---|---|
-| Anonymous core assessment | PRD §3.1, §9.1 | TRD §5, §10; UML anonymous sequence | ADR-0002, ADR-0003, ADR-0005 | Session lifecycle primitives implemented, including creation bound to one published locale-specific release; anonymous credential/HTTP flow is Target |
+| Anonymous core assessment | PRD §3.1, §9.1 | TRD §5, §10; UML anonymous sequence | ADR-0002, ADR-0003, ADR-0005 | Session lifecycle primitives implemented, including creation bound to one published locale-specific release; `src/session_http.rs` mints in-process `POST /v1/sessions` and `GET /v1/sessions/{session_ref}` with RFC 9457 problems. Anonymous credential issuance, durable session persist, and remaining public families remain Target |
 | Pause/resume | PRD §3.1, §9.1 | TRD §5 | ADR-0005 | **Implemented** in `src/session.rs` with fail-closed transitions |
 | Sequence-aware item delivery evidence | PRD §3.1, §9 | TRD §5–7 | ADR-0005, ADR-0010 | **Implemented** domain primitive in `src/item_delivery.rs`; persistence/API delivery orchestration is Target |
 | Idempotent response events | PRD §9.2 | TRD §6 | ADR-0005, ADR-0010 | **Implemented** in `src/response.rs` with canonical SHA-256 payload-digest identity; persistence adapter is Target |
@@ -45,14 +45,14 @@ An active PR, architecture document, conversation decision, or scheduler plan is
 | WCAG 2.2 AA supported reference client | PRD §9.10 | TRD §27; Quality Attributes | ADR-0002, ADR-0013 | Target; no reference client implementation on evaluated main |
 | EMA/ESM longitudinal flow | PRD §4 | TRD §16; UML longitudinal sequence; logical ERD extension | ADR-0008 | External Gyeot/TEPP dependencies + Target Commons enrollment/normalized-ingestion/orchestration adapter |
 | Measurement Workbench | PRD §6 | C4/component view; UML publication-evidence sequence; Measurement Governance | ADR-0001, ADR-0002, ADR-0004, ADR-0019 | Target; fast-mlsirm/Inkspan/RankWeave are External dependencies |
-| Headless replaceable clients | PRD §7 | TRD §1, §18; C4 | ADR-0001, ADR-0002 | Architecture established; public transport is Target |
+| Headless replaceable clients | PRD §7 | TRD §1, §18; C4 | ADR-0001, ADR-0002 | Architecture established; `openapi/sessions.yaml` plus `src/session_http.rs` implement the first public session create/reload family. Remaining public/admin families remain Target |
 | Community/Hosted/Enterprise profiles | PRD §7, §13 | TRD deployment sections; Deployment/Operations | ADR-0011, ADR-0017 | Target deployment packaging/evidence |
 
 ## 3. Technical invariant traceability
 
 | Invariant | Source | Enforcement/evidence on evaluated main | Missing evidence before GA |
 |---|---|---|---|
-| Server-authoritative session state | TRD §5 | `src/session.rs` + session contract tests, including published-release/locale binding at creation | persistence/API concurrency test |
+| Server-authoritative session state | TRD §5 | `src/session.rs` + `src/session_http.rs` create/reload over HTTP with idempotent replay | persistence/API concurrency test |
 | Only Active accepts responses | TRD §5–6 | `SessionState::accepts_responses` + response tests | transport-level rejection test |
 | Item delivery sequence is positive and evidence-safe | TRD §5–7 | `src/item_delivery.rs` + item-delivery domain tests | durable uniqueness/order/API integration |
 | Conflicting idempotency replay fails closed | TRD §6 | `src/response.rs` | DB uniqueness/concurrency test |
@@ -116,7 +116,8 @@ src/lib.rs
 ├── result.rs         # immutable result provenance/supersession
 ├── scoring.rs        # version-pinned scoring dispatch contract
 ├── scoring_job.rs    # bounded retry/quarantine lifecycle with lease fencing
-└── session.rs        # server-authoritative assessment-session transitions bound to a published locale release
+├── session.rs        # server-authoritative assessment-session transitions bound to a published locale release
+└── session_http.rs   # in-process POST /v1/sessions and GET /v1/sessions/{session_ref}
 
 migrations/
 ├── 0001_integration_delivery.sql
@@ -128,7 +129,7 @@ migrations/
 └── 0012_integration_consumption.sql
 ```
 
-Still-Target logical modules/adapters include remaining product aggregate persistence/repositories, public/admin HTTP and event transports, live fast-mlsirm/Keyverse/Gyeot/TEPP/semantic-data-portal adapters, research-release staging, deterministic narrative mapping, longitudinal normalized ingestion, participant identity-link history persistence, runtime health transports/metrics, and Measurement Workbench orchestration.
+Still-Target logical modules/adapters include remaining product aggregate persistence/repositories, remaining public/admin HTTP and event transports, live fast-mlsirm/Keyverse/Gyeot/TEPP/semantic-data-portal adapters, research-release staging, deterministic narrative mapping, longitudinal normalized ingestion, participant identity-link history persistence, runtime health transports/metrics, and Measurement Workbench orchestration. Session HTTP in this change set is in-process only; PostgreSQL session durability remains Active PR.
 
 ### Active implementation work that is not protected-main truth
 
@@ -190,7 +191,7 @@ Whenever a durable conversation decision changes one of those boundaries, the ap
 
 The prose API/event families in TRD are architecture requirements, not evidence of an implemented transport.
 
-When the first HTTP API is implemented, the same PR or a prerequisite PR must add and validate an OpenAPI 3.2.x document whose operations and problem responses match the actual implementation. HTTP errors use RFC 9457 problem details unless a documented domain representation is more appropriate.
+The first implemented public HTTP family is `POST /v1/sessions` and `GET /v1/sessions/{session_ref}` in `src/session_http.rs`, described by `openapi/sessions.yaml` (OpenAPI 3.2.0). HTTP errors use RFC 9457 problem details. That document lists only those two operations. Remaining TRD families stay Target and must not be added to the as-built contract until they exist.
 
 When durable message transport is implemented, the same PR or a prerequisite PR must add and validate an AsyncAPI 3.1.x document for actually produced/consumed event channels and message schemas. It must encode/reference ADR-0014 canonical UTF-8 payload hashing, SHA-256 payload digest semantics, tenant/resource binding, deduplication identity, pending/processing/completed consumption, replay retention, and quarantine behavior.
 
@@ -220,8 +221,10 @@ CI should validate linked documentation paths and status/name consistency now an
 
 ## 10. References
 
+Fielding, R., Nottingham, M., & Reschke, J. (Eds.). (2022). *HTTP semantics* (RFC 9110). Internet Engineering Task Force. https://doi.org/10.17487/RFC9110
+
 Nottingham, M., Wilde, E., & Dalal, S. (2023). *Problem Details for HTTP APIs* (RFC 9457). Internet Engineering Task Force. https://doi.org/10.17487/RFC9457
 
-OpenAPI Initiative. (2025). *OpenAPI Specification, Version 3.2.0*.
+OpenAPI Initiative. (2025). *OpenAPI Specification, Version 3.2.0*. https://spec.openapis.org/oas/v3.2.0
 
 AsyncAPI Initiative. (2026). *AsyncAPI Specification, Version 3.1.0*.
diff --git a/docs/adr/0014-api-and-event-contract-representation.md b/docs/adr/0014-api-and-event-contract-representation.md
@@ -6,7 +6,7 @@
 - Scope: Psychometrics Commons public/admin HTTP APIs, product-owned durable domain events, errors, schema/version negotiation
 - Supersedes: none
 - Superseded by: none
-- Current/as-built status: public/admin HTTP transport and durable external event transport are not yet implemented on protected main; current Rust domain contracts are transport-neutral
+- Current/as-built status: `src/session_http.rs` and `openapi/sessions.yaml` implement in-process `POST /v1/sessions` and `GET /v1/sessions/{session_ref}` with RFC 9457 problem details; remaining public/admin HTTP families and durable external event transport are not implemented on protected main
 - Target status: every implemented HTTP/event surface has an exact versioned machine-readable as-built contract and deterministic integrity/idempotency semantics
 - Migration status: no deployed HTTP/event transport requires migration yet; the first implementation must introduce the contract in the same or prerequisite PR
 

diff --git a/docs/doctoring/standards-and-evidence.md b/docs/doctoring/standards-and-evidence.md
@@ -1,7 +1,7 @@
 # Standards and Evidence Baseline
 
 - Status: Living doctoring record
-- Last reviewed: 2026-08-11
+- Last reviewed: 2026-08-16
 - Scope: Psychometrics Commons product, hosted runtime, reference clients, optional AI, identity integration, and assessment governance
 
 This record identifies authoritative standards and primary guidance that materially constrain product design. It is not a certification claim. Each implementation PR that relies on one of these sources must translate the source into a concrete requirement, test, control, or ADR rather than citing it decoratively.
@@ -94,6 +94,17 @@ Product consequences:
 - analysis-set digests bind the exact observations and time semantics consumed by
   temporal, multilevel, cross-classified, or multiple-membership analysis.
 
+## HTTP APIs and problem details
+
+The first public HTTP family uses HTTP Semantics (RFC 9110) for method, target, and status meaning, and RFC 9457 problem details for fail-closed client errors. OpenAPI 3.2.0 is the as-built contract vocabulary required by ADR-0014. These sources constrain the session create/reload wire format; they do not authorize listing unimplemented TRD families as available operations.
+
+Product consequences:
+
+- `POST /v1/sessions` is the only state-changing public operation in this slice and requires an opaque `Idempotency-Key`;
+- problem responses use `application/problem+json` with an explicit product URN type, never `about:blank` or raw request/SQL/provider text;
+- `openapi/sessions.yaml` lists only the implemented create and reload operations;
+- hosted listeners bind `0.0.0.0:$PORT`; tests bind `127.0.0.1:0`.
+
 ## Evidence maintenance rules
 
 1. Review this baseline when a referenced standard is revised, withdrawn, superseded, or materially amended.
@@ -124,3 +135,9 @@ Temoshok, D., Proud-Madruga, D., Choong, Y.-Y., Galluzzo, R., Gupta, S., LaSalle
 World Wide Web Consortium. (2024). *Web Content Accessibility Guidelines (WCAG) 2.2* (W3C Recommendation, 12 December 2024). https://www.w3.org/TR/WCAG22/
 
 World Wide Web Consortium. (2013). *PROV-DM: The PROV data model* (W3C Recommendation, 30 April 2013). https://www.w3.org/TR/prov-dm/
+
+Fielding, R., Nottingham, M., & Reschke, J. (Eds.). (2022). *HTTP semantics* (RFC 9110). Internet Engineering Task Force. https://doi.org/10.17487/RFC9110
+
+Nottingham, M., Wilde, E., & Dalal, S. (2023). *Problem details for HTTP APIs* (RFC 9457). Internet Engineering Task Force. https://doi.org/10.17487/RFC9457
+
+OpenAPI Initiative. (2025). *OpenAPI Specification Version 3.2.0*. https://spec.openapis.org/oas/v3.2.0