Define the service execution contract, attribution, coverage, and limit semantics #1042

Parent: #1041

Deliverable: a reviewed backend service contract that the Looking Glass consumer and Galactic implementation can use without inventing incompatible authorization, result, or execution rules.

Define the four supported diagnostics, trusted project and request attribution, cell-scoped service identity, capability discovery, absolute deadlines, incremental router outcomes, terminal coverage, typed failures, and retry guidance. Separate backend execution from customer authentication, session claims, and project IAM, which remain outside Galactic. Specify compatibility with existing operator and FabricQuery interfaces.

Work items:

• Define the service interface, identity and attribution trust boundary, capability compatibility, and supported diagnostic inputs and outputs.
• Specify discovery snapshot and coverage semantics, including omitted routers, partial results, truncation, cancellation, and interrupted streams.
• Select admission and execution limit mechanisms, including project fairness, destination aggregation, fan-out accounting, replica coordination, and safe behavior during limiter failure or leadership change.
• Specify numeric execution and cancellation bounds, initial limit defaults, failure assumptions, and an acceptance matrix; define how the generated API is published for external consumers.

Dependencies: none; feasibility experiments may inform the contract.

Acceptance: The contract resolves the decisions required by subsequent milestones and includes wire examples, compatibility rules, rate-limit accounting, numeric failure bounds, and a failure-test matrix. It permits a consumer outside the Galactic repository to integrate through a supported API without importing internal packages. It does not claim that backend request deduplication supplies the customer service's durable single-use session guarantee.