{
  "_comment": "Golden DISCOVERY fixture for uat-plan (the plan's named personas.json). Roles are deliberately scrambled to prove canonicalRoleOrder; grants mix wildcard + exact to exercise rbac-matrix. Drives the byte-stable expected.plantest.yml.",
  "application": "administration",
  "path": "administration",
  "routes": [
    {
      "componentKey": "administration.users",
      "baseRoute": "/administration/users",
      "label": "Users",
      "permission": "administration.users.read",
      "navKind": "section",
      "views": ["list", "detail", "create"],
      "parentComponentKey": "administration"
    },
    {
      "componentKey": "administration.roles",
      "baseRoute": "/administration/roles",
      "label": "Roles",
      "permission": "administration.roles.read",
      "navKind": "section",
      "views": ["list"]
    }
  ],
  "endpoints": [
    {
      "method": "GET",
      "route": "/api/administration/users",
      "controller": "UsersController",
      "permission": "administration.users.read",
      "navRoute": "administration.users",
      "okStatus": 200
    },
    {
      "method": "POST",
      "route": "/api/administration/users",
      "controller": "UsersController",
      "permission": "administration.users.create",
      "navRoute": "administration.users",
      "okStatus": 201
    },
    {
      "method": "GET",
      "route": "/api/administration/roles",
      "controller": "RolesController",
      "permission": "administration.roles.read",
      "navRoute": "administration.roles",
      "okStatus": 200
    }
  ],
  "rbac": {
    "roles": ["viewer", "anonymous", "admin", "manager", "super-admin", "contributor"],
    "grantsByRole": {
      "super-admin": [{ "path": "administration", "isWildcard": true }],
      "admin": [
        { "path": "administration.users", "isWildcard": true },
        { "path": "administration.roles.read", "isWildcard": false }
      ],
      "manager": [{ "path": "administration.users.read", "isWildcard": false }],
      "contributor": [],
      "viewer": [{ "path": "administration.users.read", "isWildcard": false }]
    }
  },
  "_comment_roleCatalog": "Keyed by role NAME; id = auth_Roles GUID (the provisioning join key). Mixed code presence mirrors the socle: most platform roles have Code NULL, only generated/extension roles carry one. anonymous is synthetic — never an entry.",
  "roleCatalog": {
    "super-admin": { "id": "00000000-0000-4000-8000-00000000000a", "code": "super-admin" },
    "admin": { "id": "00000000-0000-4000-8000-00000000000b" },
    "manager": { "id": "00000000-0000-4000-8000-00000000000c", "code": "team-manager" },
    "contributor": { "id": "00000000-0000-4000-8000-00000000000d" },
    "viewer": { "id": "00000000-0000-4000-8000-00000000000e" }
  },
  "signature": {
    "nav_sha": "1111111111111111111111111111111111111111111111111111111111111111",
    "rbac_sha": "2222222222222222222222222222222222222222222222222222222222222222",
    "registry_sha": "3333333333333333333333333333333333333333333333333333333333333333"
  }
}