control plane api

Evaluations and frozen cohorts

Select supplier-blind capture metadata from one workload and freeze exact capture references into an immutable cohort. All routes accept the same tenant-scoped authentication as the CLI.

Endpoints

method & path	does
`GET .../workloads/:workload_id/eval-capture-catalog`	Returns bounded, redacted metadata and content hashes. Filter by time, model, status, tool presence, structured output, limit, and deterministic sample seed.
`POST .../workloads/:workload_id/eval-cohorts`	Verifies 1–500 exact capture references against R2, freezes their order and selection metadata, and returns a server-computed cohort hash.
`GET .../workloads/:workload_id/eval-cohorts`	Lists immutable cohorts for the workload without returning capture bodies.
`POST .../eval-cohorts/:cohort_id/export`	Returns 501 while customer-safe export materialization is being introduced; raw forensic objects remain operator-only.
`POST/GET .../eval-specs and .../eval-runs`	Stores immutable eval definitions and compact run summaries tied to a workload and cohort.

Capture catalog

catalog request

GET /admin/v1/orgs/org_.../projects/proj_.../workloads/usp_.../eval-capture-catalog
  ?from=2026-07-01T00:00:00Z
  &to=2026-07-15T00:00:00Z
  &limit=50
  &sample_seed=july-parity
  &status_code=200
  &requires_tools=true

The response includes capture_key, request_id, content_sha256, time, the public requested model, status, latency, and shape flags. It excludes request and response bodies, serving models, suppliers, and deployment identifiers. The maximum window is 31 days and the maximum returned set is 100 captures.

Freeze a cohort

Create a cohort by posting the catalog's exact capture references and hashes. Understudy re-reads each R2 object, checks workload ownership, and rejects stale or modified content. Customer export is temporarily unavailable while sanitized artifacts are materialized separately from operator-only forensic captures.