# Journal management surface

**Status:** initial management contract, 2026-09-11.

This surface reports whether this Journal process can answer and whether its
durable store is ready, and describes its own contract. It is separate from
the [journal operations contract](../SURFACE.md). It adds no journal creation,
append, read, listing, statistics or payload interpretation.

## Operations

| Operation | Result |
|---|---|
| `livez` | Process liveness; the standard health envelope with empty checks |
| `health` | Store and stable instance identity readiness checks |
| `describe` | This management surface's identity, build and contract inventory |
| `describe_file` | One listed, embedded management contract file verbatim |

Liveness never reports dependency failure. Readiness reports failing status
when the store cannot answer or its instance identity is invalid or changed.
Neither operation reads journal payloads. Instance identity identifies the
store lineage and supplies no caller authority.

The management listener is independently configurable and cannot dispatch
the journal operations. Management is intended for a private network in
deployment; network exposure is an explicit deployment decision. There is
no authentication or authorization added by this surface.

Refusals use the existing JSON error envelope: `invalid` for request shape,
`not_found` for an absent management route or description file, and `internal`
for an unexpected failure. Readiness failure is a health envelope, not a
domain refusal. Generated descriptions derive from `journal.ManagementOperations`.