D5-S16 — The administration shell

[The-Running-Dev]

What changed, and why. Adds the administration shell (D5-S16): a separate front-end build (shell/) with no .NET package, consuming four new endpoints on the sample host — /api/me, /api/organizations/{id}/switch, /api/entitlement, /api/audit — mapped and permission-gated the same way /orders already is. The endpoints live on the sample host rather than in a new module because the modules they read (IOrganizationApi, IEntitlementEvaluator, ILicenceState, IAuditReadApi) already declare exactly the C# surface the contract calls for; HTTP mapping is a hosting concern the contract leaves to whoever composes a deployment, the same way /orders and /boom already are. Organizations, Billing and Licensing are now registered on the sample host so those reads have something real behind them.

Closes #184

Verified

Ran and passed:

• build.yml / build — Test — dotnet test --no-build --configuration Release --verbosity normal: Total tests: 457, Passed: 456, Skipped: 1, 40.90s. The one skip is McpInvocationTests.A_cancelled_call_writes_no_audit_record_and_never_completes_the_invoker, quarantined with full documentation — it hangs on a confirmed, open upstream bug in ModelContextProtocol.Core 2.2.0's client (Cancellation support via CancellationToken's fails modelcontextprotocol/csharp-sdk#1365: cancelling a client CancellationToken over streamable-HTTP never sends notifications/cancelled, so the server-side invoker's token is never triggered), unmerged fix at csharp-sdk#1377. Confirmed the root cause with VSTest's --blame-hang and SDK trace logging; Platform's own server-side cancellation wiring is correct and unaffected. Tracked in Re-enable McpInvocationTests.A_cancelled_call_writes_no_audit_record_and_never_completes_the_invoker once the SDK ships the cancellation fix #224 to re-enable once a fixed SDK version ships.
• build.yml / build — Assert no framework project references a workload — pwsh ./build/Test-WorkloadIsolation.ps1: no project under src/ or samples/ references workloads/ (46 project files checked).
• build.yml / game-service — Typecheck — tsc --noEmit, no output, exit 0.
• build.yml / game-service — Start the workload and the edge, the documented way — both /livez//readyz and GameEdge's /health/live//health/ready reported healthy.
• build.yml / game-service — Run the replay against the workload — 11/11 tests.
• build.yml / game-service — Run the replay against the edge — 2/2 tests.
• build.yml / game-service — Migrate the schema to head, the documented way — migrated to head.
• build.yml / game-service — Start the workload against the durable store, the documented way — /readyz healthy.
• build.yml / game-service — Run the one-instance contention proof — 5/5 tests.
• build.yml / game-service — Run the two-instance contention proof — 7/7 tests.
• build.yml / game-service — Run the durable replay — 7/7 tests.
• build.yml / game-service — Run the port-conformance suite — 7/7 tests.
• docs-ci.yml / documentation — Validate Markdown links, terminology, and generated files — 127 Markdown files, 2 pre-existing warnings (unrelated to this branch).
• docs-ci.yml / slice-status-markers — Validate design/30-slices.md's Status markers — consistent across 3 slices.
• docs-ci.yml / verify — Build and verify the status-page site — 57/57 tests, build and merge checks passed.
• docs-deploy.yml / deploy — Build and verify the status-page site — identical command to the gate above, confirmed by that same run.
• Parse-check PowerShell scripts — 41 files, no parse errors.
• Validate the core/companion split — ./tools/Test-Companion.ps1: 23 core(s) checked, 0 companions present, Valid.

Ran and failed:

• build.yml / game-service — Test (workloads/game-service's own combined suite, GAME_EDGE_DLL + OTEL_COLLECTOR_BIN set) — 197/198 passed; tests/trace-evidence.test.ts failed with SyntaxError: Unterminated string in JSON at position 276. This reproduces a pre-existing, environment-specific issue (a Windows build of the OTEL Collector substituted for CI's Linux binary) — the same 197/198 ratio against this same test was recorded in a prior session against this repository before this branch existed.
• Run Pester tests — 268/291 passed. The one failure, tools/Test-TrackCommand.Tests.ps1's names Update-DesignProjection.ps1 (a real run, not -DryRun) after the work-mirror refresh, is pre-existing and unrelated to this branch: .claude/commands/track.md, the file it inspects, carries no diff against origin/main.

Did not run:

• build.yml / build — Run the sample in both roles — build/Test-SampleRoundTrip.ps1 states in its own header that it is "Linux-only, and it always was" (P/Invokes libc's kill(2), reads the store with sqlite3 on POSIX assumptions); this session is Windows. The corresponding CI check (ubuntu-latest) is where the answer comes from.
• Check the design state against the tree — ./tools/Test-DesignState.ps1 exited 2 (could-not-evaluate): ContractListUnreadable (SectionNotFound in design/20-contract.md) and StateSetAbsent (design/state/ holds no records beyond WorkRef mirrors). Pre-existing and unrelated to this branch: neither file carries a diff against origin/main.

---

Agent detail

• Slice: S16 — design/30-slices.md § S16 @ d752008
• Criteria met: S16.1, S16.2, S16.3, S16.4, S16.5, S16.6, S16.7
• Left undone: none