Fix/release tracks production readiness

app/api/definitions/components/release-tracks.yml

@@ -23,6 +23,12 @@ components:
           nullable: true
           description: 'Semantic version (e.g., "1.0", "2.1") if tagged, null for draft snapshots'
           example: '1.0'
+        graph_manifest_id:
+          type: string
+          readOnly: true
+          description: |
+            Server-controlled identifier for the frozen bundle graph associated
+            with this snapshot. Clients should treat this value as opaque.
         name:
           type: string
           description: 'Human-readable track name'
@@ -676,3 +682,74 @@ components:
           type: string
           format: date-time
           description: 'UTC occurrence timestamp; also serves as the idempotency key'
+
+    object-revision-reference:
+      type: object
+      required:
+        - object_ref
+        - object_modified
+      properties:
+        object_ref:
+          type: string
+          description: 'STIX object ID'
+        object_modified:
+          type: string
+          format: date-time
+          description: 'Exact STIX revision timestamp'
+
+    object-revision-error:
+      type: object
+      required:
+        - message
+        - missing_references
+      properties:
+        message:
+          type: string
+          description: 'Whether request input or persisted primary content failed validation'
+        missing_references:
+          type: array
+          minItems: 1
+          items:
+            $ref: '#/components/schemas/object-revision-reference'
+
+    release-track-reconciliation-error:
+      type: object
+      required:
+        - message
+        - track_id
+        - reconciliation_id
+      properties:
+        message:
+          type: string
+          enum:
+            - 'Release-track membership protection could not be reconciled'
+        details:
+          type: string
+          description: 'Operator guidance; the track mutation may already be persisted'
+        track_id:
+          type: string
+          description: 'Release track whose object backrefs require repair'
+        reconciliation_id:
+          type: string
+          format: uuid
+          description: 'Durable reconciliation record to inspect or repair'
+
+    release-track-audit-error:
+      type: object
+      required:
+        - message
+        - track_id
+        - audit_event_id
+      properties:
+        message:
+          type: string
+          enum:
+            - 'Release-track audit recording could not be finalized'
+        details:
+          type: string
+          description: 'Operator guidance; the destructive operation may already be persisted'
+        track_id:
+          type: string
+        audit_event_id:
+          type: string
+          format: uuid

app/api/definitions/openapi.yml

@@ -352,9 +352,6 @@ paths:
   /api/release-tracks/{id}/meta:
     $ref: 'paths/release-tracks-paths.yml#/paths/~1api~1release-tracks~1{id}~1meta'
 
-  /api/release-tracks/{id}/contents:
-    $ref: 'paths/release-tracks-paths.yml#/paths/~1api~1release-tracks~1{id}~1contents'
-
   /api/release-tracks/{id}/clone:
     $ref: 'paths/release-tracks-paths.yml#/paths/~1api~1release-tracks~1{id}~1clone'
 
@@ -409,12 +406,6 @@ paths:
   /api/release-tracks/{id}/snapshots/{modified}:
     $ref: 'paths/release-tracks-paths.yml#/paths/~1api~1release-tracks~1{id}~1snapshots~1{modified}'
 
-  /api/release-tracks/{id}/snapshots/{modified}/meta:
-    $ref: 'paths/release-tracks-paths.yml#/paths/~1api~1release-tracks~1{id}~1snapshots~1{modified}~1meta'
-
-  /api/release-tracks/{id}/snapshots/{modified}/contents:
-    $ref: 'paths/release-tracks-paths.yml#/paths/~1api~1release-tracks~1{id}~1snapshots~1{modified}~1contents'
-
   /api/release-tracks/{id}/snapshots/{modified}/clone:
     $ref: 'paths/release-tracks-paths.yml#/paths/~1api~1release-tracks~1{id}~1snapshots~1{modified}~1clone'
 

app/api/definitions/paths/analytics-paths.yml

@@ -206,7 +206,7 @@ paths:
         '404':
           description: 'A analytic with the requested STIX id was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/analytics/{stixId}/modified/{modified}:
     get:
@@ -278,7 +278,7 @@ paths:
         '404':
           description: 'A analytic with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a analytic'
       operationId: 'analytic-delete'
@@ -306,4 +306,4 @@ paths:
         '404':
           description: 'A analytic with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'

app/api/definitions/paths/assets-paths.yml

@@ -270,7 +270,7 @@ paths:
         '404':
           description: 'An asset with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete an asset'
       operationId: 'asset-delete'
@@ -298,7 +298,7 @@ paths:
         '404':
           description: 'An asset with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/assets/{stixId}/revoke:
     post:

app/api/definitions/paths/campaigns-paths.yml

@@ -178,7 +178,7 @@ paths:
         '404':
           description: 'A campaign with the requested STIX id was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/campaigns/{stixId}/modified/{modified}:
     get:
@@ -250,7 +250,7 @@ paths:
         '404':
           description: 'A campaign with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a campaign'
       operationId: 'campaign-delete'
@@ -278,7 +278,7 @@ paths:
         '404':
           description: 'A campaign with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/campaigns/{stixId}/revoke:
     post:

app/api/definitions/paths/collections-paths.yml

@@ -199,6 +199,8 @@ paths:
           description: 'The collections were successfully deleted.'
         '404':
           description: 'A collection with the requested STIX id was not found.'
+        '409':
+          description: 'The collection revision or a requested cascade-delete target is pinned by release-track membership or a snapshot graph manifest and cannot be deleted.'
 
   /api/collections/{stixId}/modified/{modified}:
     get:
@@ -277,3 +279,5 @@ paths:
           description: 'The collection was successfully deleted.'
         '404':
           description: 'A collection with the requested STIX id was not found.'
+        '409':
+          description: 'The collection revision or a requested cascade-delete target is pinned by release-track membership or a snapshot graph manifest and cannot be deleted.'

app/api/definitions/paths/data-components-paths.yml

@@ -190,7 +190,7 @@ paths:
         '404':
           description: 'A data component with the requested STIX id was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/data-components/{stixId}/channels:
     get:
@@ -316,7 +316,7 @@ paths:
         '404':
           description: 'A data component with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a data component'
       operationId: 'data-component-delete'
@@ -344,7 +344,7 @@ paths:
         '404':
           description: 'A data component with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/data-components/{stixId}/revoke:
     post:

app/api/definitions/paths/data-sources-paths.yml

@@ -286,7 +286,7 @@ paths:
         '404':
           description: 'A data source with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a data source'
       operationId: 'data-source-delete'
@@ -314,7 +314,7 @@ paths:
         '404':
           description: 'A data source with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/data-sources/{stixId}/revoke:
     post:

app/api/definitions/paths/detection-strategies-paths.yml

@@ -190,7 +190,7 @@ paths:
         '404':
           description: 'A detection strategy with the requested STIX id was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/detection-strategies/{stixId}/modified/{modified}:
     get:
@@ -262,7 +262,7 @@ paths:
         '404':
           description: 'A detection strategy with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a detection strategy'
       operationId: 'detection-strategy-delete'
@@ -290,4 +290,4 @@ paths:
         '404':
           description: 'A detection strategy with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'

app/api/definitions/paths/groups-paths.yml

@@ -178,7 +178,7 @@ paths:
         '404':
           description: 'A group with the requested STIX id was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/groups/{stixId}/modified/{modified}:
     get:
@@ -250,7 +250,7 @@ paths:
         '404':
           description: 'A group with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a group'
       operationId: 'group-delete'
@@ -278,7 +278,7 @@ paths:
         '404':
           description: 'A group with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/groups/{stixId}/revoke:
     post:

app/api/definitions/paths/identities-paths.yml

@@ -227,7 +227,7 @@ paths:
         '404':
           description: 'An identity with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a identity'
       operationId: 'identity-delete'
@@ -255,4 +255,4 @@ paths:
         '404':
           description: 'An identity with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'

app/api/definitions/paths/matrices-paths.yml

@@ -178,7 +178,7 @@ paths:
         '404':
           description: 'A matrix with the requested STIX id was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/matrices/{stixId}/modified/{modified}:
     get:
@@ -250,7 +250,7 @@ paths:
         '404':
           description: 'A matrix with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a matrix'
       operationId: 'matrix-delete'
@@ -278,7 +278,7 @@ paths:
         '404':
           description: 'A matrix with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/matrices/{stixId}/modified/{modified}/techniques:
     get:

app/api/definitions/paths/mitigations-paths.yml

@@ -190,7 +190,7 @@ paths:
         '404':
           description: 'A mitigation with the requested STIX id was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/mitigations/{stixId}/modified/{modified}:
     get:
@@ -262,7 +262,7 @@ paths:
         '404':
           description: 'A mitigation with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
     delete:
       summary: 'Delete a mitigation'
       operationId: 'mitigation-delete'
@@ -290,7 +290,7 @@ paths:
         '404':
           description: 'A mitigation with the requested STIX id and modified date was not found.'
         '409':
-          description: 'The version is pinned in the members tier of a release track (released content) and cannot be modified or deleted in place. Create a new revision instead.'
+          description: 'The version is pinned by release-track membership or a snapshot graph manifest and cannot be modified or deleted in place. Create a new revision instead.'
 
   /api/mitigations/{stixId}/revoke:
     post: