API Gateway (COMP-001): M2 items — thin-client layout, OpenAPI extension schema, device-code page, rate-limiter, multi-region

[toddysm]

Context

API Gateway (COMP-001) M1 is implemented — tracker #732 (AGW-IMPL, 21 tasks) is closed with 0 open children. On 2026-08-28 the registry was corrected Designed → Implemented. The items below are the remaining M2 design/spec items from design/components/api-gateway/todos.md.

What's missing (M2)

• Specify the per-component thin-client package layout (custos-<service>-routes) that the gateway imports for route + Pydantic model registration
• Define the OpenAPI extension schema (x-custos-required-permission, x-custos-idempotent) and pin its semver
• Decide whether the OIDC device-code landing page is server-rendered by the gateway or a redirect into the Web UI (M1 vs M2)
• Specify the coordinated rate-limiter design for M2 (Dapr state-backed or Redis)
• Specify the multi-region routing model (M2+)

Design references

• design/components/api-gateway/design.md
• design/components/api-gateway/todos.md

Acceptance criteria

• Each item has a documented decision in design.md
• Items entailing code get a follow-up implementation task filed

---

Filed 2026-08-28 during status reconciliation of design/architecture/components.md.