# Runtime Adapter Contract

`js/app.js` is intentionally read-only.

## Required behavior

- GET only.
- No write, POST, PUT, PATCH, DELETE or shell calls.
- No credentials stored in the front-end.
- No secret token in `config.js`.
- If authentication is needed, terminate it server-side or use same-origin session controls.

## Minimal payload

```json
{
  "schemaVersion": 1,
  "classification": "LIVE",
  "source": "read-only runtime aggregator",
  "capturedAt": "2026-09-16T01:00:00+03:00",
  "freshness": "current",
  "liveConnected": true,
  "headline": "Verified current runtime",
  "cluster": {
    "label": "MetaCore Cluster",
    "status": "OPERATIONAL",
    "bridgeVersion": "x.y.z",
    "labMcpBuild": "build-id"
  },
  "nodes": [],
  "metrics": [],
  "security": [],
  "events": []
}
```

Remote values are inserted using `textContent`, not HTML.

## Failure behavior

If the live endpoint fails, the UI falls back to the bundled dated snapshot and visibly switches to `SNAPSHOT MODE`.