# Dawn management HTTP binding

This listener carries [SURFACE.md](SURFACE.md), contract 2026-09-12, independently
from the authenticated operation listener. Every response, including refusals,
sets `Ulab-Service: dawn`, `Ulab-Surface: management` and
`Ulab-Contract: 2026-09-12`. No Dawn-Auth carriage or login is required or processed.

These native routes are relative to the management listener root. Deployment
mounts the listener under `/api/management/` and strips `/api/management` before
forwarding. For example, an externally routed health request is
`GET /api/management/healthz`. The operations listener is separately mounted
under `/api/operations/`; management clients receive their own explicit base URL.

| Method | Route | Success |
|---|---|---|
| GET | /livez | 200 Health, empty checks, no dependency calls |
| GET | /healthz | 200 Health when ready; 503 with the same shape when failing |
| GET | /describe | 200 Describe for the management surface only |
| GET | /describe/{file...} | 200 exact embedded bytes of a listed file |

Only GET is accepted. Known routes with other methods return 405
`method_not_allowed` and `Allow: GET`; unknown routes return 404 `not_found`.
Every route rejects any query component, including empty, repeated or unknown
parameters, and rejects any request body (400 `invalid`). A trailing bare `?`
is also refused. Request paths are exact: no redirect, path cleaning or fallback
to core dispatch is performed. A file path must exactly match the descriptor's
inventory; traversal paths and unknown files return 404.

Health and descriptions use `application/json`. Files use `application/json`
for JSON and `text/markdown; charset=utf-8` for Markdown, with Content-Length.
Every JSON refusal has `{ "error": "code", "message": "explanation" }` and may
have a `details` object. No request body is interpreted as a command.
The server gives dependency health checks a ten-second deadline. A cancelled
request can stop observation but has no persistent effect.

Example calls against the standalone management listener:

```sh
curl http://127.0.0.1:8094/healthz
curl http://127.0.0.1:8094/describe
curl http://127.0.0.1:8094/describe/SURFACE.md
curl 'http://127.0.0.1:8094/healthz?unexpected=1' # 400 invalid
curl http://127.0.0.1:8094/v1/children # 404 not_found
```