# 8.10 — Phase 8 gate: every service on `ServiceAdapter` + KV-schema (GREEN)

Phase: 8 — ServiceAdapter CRD rollout
Stage: gate
Depends on: 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8 (8.9 optional — see below)

Purpose: confirm all real backend services — `workflow`, `s3`, `sqs`, `iam`,
`memory` — are onboarded through the `ServiceAdapter` CRD with `requestSchema`/
`responseSchema` validation (8.3's DSL), none of them left on hand-written
`switch`-case Go routes or the old path-prefix scheme (`/workflow/*`, `/sqs/*`,
`/db/*`). This is the "make sure every service adapts to this format" checkpoint —
it does not add new capability, it verifies consistency across what 8.4–8.8 built.

- [ ] `kubectl -n api get serviceadapters` lists exactly `workflow`, `s3`, `sqs`,
      `iam`, `memory` (plus `postgres` only if that example CR was actually applied
      as a real onboarding, not just kept as doc illustration)
- [ ] No adapter's CR has an empty `requestSchema` on a method that accepts a body
      — every write path validates input
- [ ] `internal/server/router.go` has no remaining path-based `switch` case for
      `/workflow`, `/sqs`, or `/db` — those prefixes 404 or are fully removed from
      the router, superseded by `X-Service` dispatch
- [ ] One curl per adapter succeeds end-to-end through the header-based path (below)
- [ ] `go test ./... -race`, `CGO_ENABLED=0 go build ./...`, `go vet ./...` all pass

## Verify

```bash
for svc_resource in "workflow:workflow" "sqs:message" "iam:user" "memory:project"; do
  svc="${svc_resource%%:*}"; res="${svc_resource##*:}"
  code=$(curl -s -o /dev/null -w '%{http_code}' https://api.riotpiao.com/ \
    -H 'Authorization: Bearer <jwt-with-all-capabilities>' \
    -H "X-Service: $svc" -H "X-Resource: $res")
  echo "$svc/$res -> $code"
done
# expected: none of the four returns 404 for "unknown X-Service" — each is a live adapter

curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/db/healthz
# expected: 404 on all three — old prefix routes are gone, not just unused

kubectl -n api get serviceadapters -o jsonpath='{range .items[*]}{.spec.serviceName}{"\n"}{end}' | sort
# expected: iam, memory, s3, sqs, workflow (plus postgres iff real)
```