# Dawn management surface

**Status:** implemented contract, 2026-09-12.

This surface observes the Dawn process. It is independent of the authenticated
world operations in [the core surface](../SURFACE.md). Management access is
determined by reachability of its separately configured listener. It carries no
worker identity, grants, login operation or implicit authority to mutate a world.
Deployments choose its network exposure; authentication is not added here.

## Operations

| Operation | Result |
|---|---|
| livez | Process liveness, without contacting dependencies |
| health | Journal and Bytes readiness checks and available world identity |
| describe | Management service, surface, contract, build, identity, binding, operations, refusals and file inventory |
| describe_file | Exact embedded bytes of a named management contract file |

All operations are reads. They create no world records, grants or login offers.
Cancellation leaves persistent state unchanged. Health is an observation made
during the request, not a guarantee about a later world operation. Liveness does
not establish dependency readiness. Identity contains only public world/root
identifiers; no root key or environment configuration is exposed.

The health shape is the shared ULab health envelope. Its contract identifies
this management surface. The descriptor's surface is `management`. The listed
operations and files describe only this surface, with independent generated
schemas and operation table. Core operations and Archon login are unreachable
through this listener. Existing core health and description endpoints remain
available for compatibility and continue to describe the core contract.

## Refusals and limits

`invalid` refuses input outside the binding grammar; `not_found` identifies an
unknown operation or contract file; `method_not_allowed` identifies a known
operation used with the wrong method. These are observations, never mutations.
Health dependency checks have a ten-second request deadline and report failing
checks when a dependency is unavailable. There is no WebSocket management binding.

See [HTTP.md](HTTP.md), [operations.json](operations.json) and
[openapi.json](openapi.json). The Go operation table and types generate machine
descriptions, held to these documents and served bytes by drift tests.