• GET /api/v1/vacancies?page=1&pageSize=5
• GET /api/v1/vacancies/VAC-GE-2026-00001
• GET /api/v1/vacancies/11e35ec4-4818-4741-868b-bb3c64cdd9f2

Owner / internal checks:

• GET /api/v1/owner/vacancy-postings
• GET /api/v1/owner/vacancy-postings/11e35ec4-4818-4741-868b-bb3c64cdd9f2
• GET /api/v1/owner/vacancy-applications
• GET /api/v1/vacancy-postings/11e35ec4-4818-4741-868b-bb3c64cdd9f2/applications

Authenticated read check:

• GET /api/v1/vacancy-applications/me

Auth-protected denial check:

• POST /api/v1/vacancy-postings without bearer token

Auth Observations

• auth behavior remained unchanged
• bearer-token principal resolution remained unchanged
• authenticated owner/internal Vacancy reads succeeded with the existing dev impersonation flow
• unauthenticated Vacancy posting creation still returned 401

Response / Status Observations

Observed live parity after cutover:

• public Vacancy list: 200
• public Vacancy detail by compatibility-backed id: 200
• public Vacancy detail by projection-backed id: 200
• owner Vacancy posting list: 200
• owner Vacancy posting detail: 200
• my applications: 200
• owner applications: 200
• posting applications: 200
• unauthenticated create denial: 401

No route-shape mismatch was observed. No gateway-specific failure was observed.

Compatibility-Truth Notes

The live cutover preserved current mixed public Vacancy truth.

That means:

• VAC-GE-2026-00001 still reflects compatibility-backed public discovery behavior
• 11e35ec4-4818-4741-868b-bb3c64cdd9f2 still reflects projection-backed preferred Vacancy truth
• both behaviors matched between gateway cutover and extracted svc-vacancies

This is a parity success for the current architecture, not proof that public Vacancy discovery is already fully cleaned up.

Anomalies

No blocking anomaly was observed.

No mismatch was classified as:

• parity drift
• auth issue
• env/config issue
• gateway-specific issue

Rollback Notes

Rollback was not used.

Rollback target remained healthy throughout the window:

• legacy svc-tenders Vacancy host on http://localhost:4020

If needed later, rollback remains:

1. point VACANCIES_SERVICE_URL back to http://localhost:4020
2. restart API
3. re-run the same smoke set