API Contract

Contract boundaries are derived from apps/okr/domain/input/okr-requirement.md. No endpoint is accepted without a requirement ID, validation contract, authorization rule, and error response.