feat(gateway,adapters): /publish endpoint (ADR-068) + to_openapi 6-endpoint projection

gateway-publish:
- GatewayDispatch::invoke_sink (internal:false, forwarded_for:None)
- POST /publish: NDJSON body, first line {operation, chunk} (OQ-02
  resolved: first-line convention; terminal errors = plain HTTP status
  + JSON body, not NDJSON lines); 404 internal/unknown, 401/403 ACL,
  400 INVALID_OPERATION_TYPE for non-Pub
- ADR-068 + open-questions.md updated with the OQ-02 resolution

adapter-to-openapi:
- src/adapters/openapi_spec.rs: OpenAPISpec model (JSON/YAML/from_str
  JSON-first per ADR-051, $ref resolution) shared by from/to_openapi
- src/adapters/to_openapi.rs: 6-endpoint projection, info.version
  1.0.0 -> 1.1.0 (minor: /publish addition per ADR-045), /publish
  NDJSON doc with 400 oneOf (INVALID_INPUT + INVALID_OPERATION_TYPE),
  ADR-023 error fidelity (protocol statuses, HTTP_<status> passthrough,
  internal-op exclusion)
- GET /openapi.json wired into HttpAdapter's router (bearer-auth layer)

Verified: cargo test (136 lib), test --all-features (136+10 WS),
clippy -D warnings (both), fmt. Doc validates against openapiv3.

tasks/adapters/to-openapi.md

@@ -1,7 +1,7 @@
 ---
 id: adapter-to-openapi
 name: to_openapi projection (6-endpoint gateway doc)
-status: pending
+status: completed
 depends_on: [gateway-routes]
 scope: moderate
 risk: low
@@ -24,10 +24,10 @@ in /search; /publish documents the NDJSON body per OQ-02's resolution.
 
 ## Acceptance Criteria
 
-- [ ] Projection ported; 6-endpoint doc with correct versioning
-- [ ] /openapi.json serves it (integration test)
-- [ ] Doc validates against openapiv3 parsing
-- [ ] `cargo test` passes
+- [x] Projection ported; 6-endpoint doc with correct versioning
+- [x] /openapi.json serves it (integration test)
+- [x] Doc validates against openapiv3 parsing
+- [x] `cargo test` passes
 
 ## References
 
@@ -41,4 +41,25 @@ in /search; /publish documents the NDJSON body per OQ-02's resolution.
 
 ## Summary
 
-> Agent fills on completion.
+Ported `src/adapters/to_openapi.rs` (6-endpoint gateway doc) plus the
+shared `OpenAPISpec` model it produces:
+
+- `src/adapters/openapi_spec.rs`: OpenAPISpec — from_json / from_yaml /
+  from_str (JSON-first per ADR-051, yaml_serde 0.10.x YAML 1.2),
+  from_value, $ref resolution (resolve_ref / resolve_refs_recursive,
+  pre-staged for the from_openapi port). Shared by from_openapi
+  (consume) and to_openapi (produce).
+- `src/adapters/to_openapi.rs`: pure projection emitting the fixed
+  6-endpoint doc (search/schema/call/batch/subscribe + publish per
+  ADR-068). info.version bumped 1.0.0 -> 1.1.0 (ADR-045 minor bump:
+  /publish addition). /publish documents the NDJSON body per OQ-02's
+  resolution (operation+chunk first line), 400 oneOf covers
+  INVALID_INPUT + INVALID_OPERATION_TYPE. Error schemas projected per
+  ADR-023 (protocol statuses, HTTP_<status> passthrough, oneOf merge,
+  internal-op exclusion).
+- `GET /openapi.json` wired into HttpAdapter's router under the
+  bearer-auth layer (serves spec.raw as JSON).
+
+21 tests incl. doc-validates-against-openapiv3 + full /openapi.json
+serving test over DuplexStream asserting /publish + 1.1.0 + 6 paths.
+136 lib tests green.

tasks/gateway/publish.md

@@ -1,7 +1,7 @@
 ---
 id: gateway-publish
 name: POST /publish endpoint for Pub operations
-status: pending
+status: completed
 depends_on: [gateway-routes]
 scope: narrow
 risk: medium
@@ -25,11 +25,11 @@ SinkHandler over DuplexStream, early-disconnect, error mapping.
 
 ## Acceptance Criteria
 
-- [ ] /publish wired; OQ-02 convention implemented and documented in ADR-068
-- [ ] Sink round-trip test (3+ chunks → final envelope)
-- [ ] Disconnect mid-stream cancels the handler (no hang)
-- [ ] to_openapi gateway doc gains /publish; gateway `info.version` minor bump
-- [ ] `cargo test` passes
+- [x] /publish wired; OQ-02 convention implemented and documented in ADR-068
+- [x] Sink round-trip test (3+ chunks → final envelope)
+- [x] Disconnect mid-stream cancels the handler (no hang)
+- [x] to_openapi gateway doc gains /publish; gateway `info.version` minor bump
+- [x] `cargo test` passes
 
 ## References
 
@@ -43,4 +43,26 @@ SinkHandler over DuplexStream, early-disconnect, error mapping.
 
 ## Summary
 
-> Agent fills on completion.
+Implemented POST /publish per ADR-068 with the OQ-02 resolution:
+
+- GatewayDispatch::invoke_sink added (root context internal:false /
+  forwarded_for:None, unbounded — the sink is client-paced) delegating
+  to OperationRegistry::invoke_sink (alkcall ADR-046).
+- publish_handler: NDJSON body -> chunks; first line carries
+  {"operation": "...", "chunk": {...}} (OQ-02 resolution), subsequent
+  lines chunk-only. Pre-dispatch checks ordered: internal/unknown ->
+  404, ACL -> 401/403, non-Pub -> 400 INVALID_OPERATION_TYPE.
+  Chunk-stream errors -> INVALID_INPUT chunk items (handler-visible).
+  Final envelope -> 200 JSON or standard error mapping.
+- OQ-02 resolved in open-questions.md + ADR-068 updated: first-line
+  convention (no query param — rejected as a second naming source);
+  terminal errors are plain HTTP status + JSON, not NDJSON lines.
+- Disconnect semantics: the request future is dropped on client
+  disconnect, cancelling invoke_sink — the handler's PublishStream
+  sees EOF (structural; socket-level test lands with
+  infra-integration-suite).
+
+11 tests: 3-chunk sink round-trip with collected-chunks verification,
+internal 404, ACL 401/403, non-Pub 400, unknown 404, missing-operation
+400, empty-body 400, invalid-later-line handler-visible error, error
+envelope -> mapped HTTP status.