{"service":"JG Intel record gateway","record":"answers are quoted from the committed record or refused with a receipt; nothing is generated in the authoritative layer","endpoints":["/ask","/ask-vector","/speak","/project","/connectors","/record/tree","/record/file","/witness/capture","/sam/entity","/sam/opportunities","/spending/awards","/request-access","/portal/"],"disclosure":"every external API this gateway can reach is listed at /connectors; credentials are held server-side only","gate":"enforced","access":"manual approval required: protected endpoints need an owner-issued X-Access-Token (POST /request-access); 401 without one, 403 revoked","public":["GET /","GET /connectors","GET /portal/","GET /portal/{name}","POST /portal/login","POST /portal/totp","POST /request-access"],"scopes":{"record":"/ask, /ask-vector, /speak, /project, /record/*, /witness/capture","connectors":"/sam/*, /spending/*"},"portal":{"routes":["/portal/","/portal/login","/portal/totp","/portal/logout"],"credential":"session token in X-Access-Token only; no cookies","factors":"password plus RFC 6238 TOTP"},"perimeter":{"credential":"X-Access-Token header only; no cookie is set or read, no query-string credential","lockout":"5 failed credentials within 900s: 429 with Retry-After for 900s","lockout_state":"shared across workers","body":"state-changing requests declare Content-Length <= 16384 bytes (/witness/capture: <= 1052672); fields bounded","request_access_throttle":"10 per 60s per client","csrf":"state-changing requests refused on Sec-Fetch-Site: cross-site, foreign Origin, or non-JSON body","cors_origins":["https://jgintel.com","https://www.jgintel.com"],"record_paths":"exact keys of the receipted repo-docs manifest; served only with matching bytes"}}