One API, one base URL, one contract
Every service is reached through one gateway, and one published OpenAPI document covers them all.
- The v1 rule is add-only: removing or retyping a field fails our own build pipeline
- Personal API keys with a scope and a per-minute request budget
- A trace id on every response, to find that one request in every service's log
- Every release note ends with what was added to the API

