T8/P1: cds.facilitator — correct-by-construction authoring service (non-LLM substance)

[mzargham]

Owner decomposition (third review, 2026-08-02) on branch feat/t8-concept-definition-app. Spec: §6.0 C3, ADR-8 amendment (BYO-LLM).

The facilitation service creates conforming models — constrained authoring per the internal eBike doctrine ("e-bike-style" facilitation: the human steers, the service assists; the protocols are the substance, the LLM assist is P4 UX): the K1 tool registry mounted as HTTP routes (cds-serve) over a session staging project; Pydantic-gated candidate writes; graded strictness (advisory verification while composing; the human K2 commit gate blocks); cds_queue_add as the escalate-never-invent dead-end.

Traceability:

• Routes == K1 whitelist → tests/unit/test_facilitator_api.py::test_tool_routes_equal_whitelist
• Candidate posture: cds_commit → 403 until P2 (K2) → test_commit_refused_403
• Structural gate: malformed/deep-invalid args → 422 → test_malformed_args_422_pydantic_gate, test_deep_validation_maps_to_422
• Committed byte-identical OpenAPI docs/services/openapi-facilitator.json → test_committed_openapi_is_current
• P4 layers the AICC/LLM sidecar over this same API (ADR-8: BYO-LLM = operator-level OpenAI-compatible triplet; MCP path is BYO by construction)

Closes only when feat/t8-concept-definition-app merges to main.

[mzargham]

P1 COMPLETE for the facilitator service (3c875bc). Routes == K1 whitelist; Pydantic gate (422 on malformed AND deep-invalid records); cds_commit → 403 until P2's K2 gate; docs/services/openapi-facilitator.json committed + drift-checked. Docs: docs/services/facilitator.md. P4 layers the AICC/LLM sidecar over this same API (ADR-8 BYO-LLM amendment, 89e0124).