# 8.4 — `X-Service: workflow` adapter, supersedes `/workflow/*` prefix (GREEN)

Phase: 8 — ServiceAdapter CRD rollout
Stage: RED
Depends on: 8.1, 8.2, 8.3

Design contract: [API_ROUTING_HYBRID_DESIGN.md](../API_ROUTING_HYBRID_DESIGN.md) §2.
Supersedes [7.3](7.3-workflow-prefix.md) — that task's prefix-based `/workflow/*`
route was itself mocked/partial (see `INDEX.md` Progress note); this task replaces
it with the header-based adapter rather than finishing it as originally specced.
Do not also try to complete 7.3's checklist — its route is retired, not extended.

- [ ] `k8s/serviceadapter-workflow.yaml` CR: `serviceName: workflow`, upstream = the
      Temporal Service in the `temporal` namespace, `auth.capability: workflow:access`
- [ ] Resource `workflow` maps: `POST` → `START_WORKFLOW`, `GET /workflow/{id}` →
      `QUERY_WORKFLOW`, `GET` (list) → `LIST_WORKFLOWS`, `DELETE /workflow/{id}` →
      `TERMINATE_WORKFLOW`, `GET /workflow/{id}/history` → `GET_WORKFLOW_HISTORY`
      (§2's mapping table)
- [ ] `requestSchema` on `START_WORKFLOW`'s POST method — fields for whatever the
      Temporal start-workflow call actually needs (namespace, workflow type, args);
      define against the real `internal/temporal` client code, not invented fields
- [ ] Long-poll/streaming semantics from the old `/workflow` handler are preserved
      unbuffered through the new dispatcher (G4 still applies)
- [ ] Nothing in this adapter registers a Temporal namespace — registration stays
      with queue-operator, same invariant as 7.3
- [ ] Old `/workflow*` path-mounted route is removed once this adapter is verified live
- [ ] Metrics/rejection counters cover this adapter with its own service label

## Verify

```bash
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/ \
  -H 'X-Service: workflow' -H 'X-Resource: workflow'
# expected: 401 without a token

curl -s -X POST https://api.riotpiao.com/ \
  -H "Authorization: Bearer $WORKFLOW_TOKEN" \
  -H 'X-Service: workflow' -H 'X-Resource: workflow' \
  -d '{"namespace": "default", "workflowType": "smoke-test", "args": []}'
# expected: 200/202, Temporal's own start-workflow response, proxied unmodified

curl -s https://api.riotpiao.com/ \
  -H "Authorization: Bearer $WORKFLOW_TOKEN" \
  -H 'X-Service: workflow' -H 'X-Resource: workflow/<id>/history'
# expected: 200, workflow history payload

kubectl -n temporal exec svc/temporal-admintools -- tctl --ad temporal-frontend:7233 namespace list | sort > /tmp/ns.after
diff /tmp/ns.before /tmp/ns.after
# expected: no diff
```