[thomasluizon]

Part of thomasluizon/orbit-tickets#218 (ORB-212).

Change and approach

Mark all six ChallengesController actions and all seven AccountabilityController actions [Obsolete]. The existing operation transformer emits deprecated: true in both generated API versions, following #660 (1d806028) and #753 (21f810ff). Every route, request, response, handler, tool, job, achievement and table continues working. Endpoint and database removal belongs to the follow-up PR.

The changes land in the two controllers, src/Orbit.Api/openapi.json, src/Orbit.Api/openapi_v2.json, and controller tests. SocialDeprecationTests checks each operation in both documents. The two existing controller test classes carry [Obsolete] because they intentionally exercise these legacy actions, following the annotation pattern in #753 without adding warning suppressions.

Deprecated operations

Method	Path
GET	/api/challenges
POST	/api/challenges
POST	/api/challenges/join
DELETE	/api/challenges/{challengeId}/leave
PUT	/api/challenges/{challengeId}/habits
GET	/api/challenges/{challengeId}
GET	/api/accountability/pairs
POST	/api/accountability/pairs
POST	/api/accountability/pairs/{pairId}/accept
DELETE	/api/accountability/pairs/{pairId}
PUT	/api/accountability/pairs/{pairId}/habits
GET	/api/accountability/pairs/{pairId}/check-ins
POST	/api/accountability/pairs/{pairId}/check-ins

Each operation is deprecated in v1 and v2.

Schema removal audit and external interface evidence

The pinned action Dockerfile selects tufin/oasdiff:v1.33.0. I read that exact version's rule registry and request-property implementation, rather than inferring severity from the check name.

All properties in the endpoint-specific request schemas that the follow-up removes are covered below. request-property-removed is WARN, below the gate's ERR threshold, so no property-level deprecation is required here.

Request schema	Properties	Check and severity
CreateChallengeBody	type, title, description, targetCount, periodStartUtc, periodEndUtc, linkedHabitIds, invitedFriendUserIds	request-property-removed, WARN
JoinChallengeBody	code, linkedHabitIds	request-property-removed, WARN
SetChallengeHabitsBody	habitIds	request-property-removed, WARN
InviteAccountabilityBuddyBody	buddyUserId, cadence, habitIds	request-property-removed, WARN
AcceptAccountabilityPairBody	habitIds	request-property-removed, WARN
SetAccountabilityHabitsBody	habitIds	request-property-removed, WARN
CheckInAccountabilityBody	note	request-property-removed, WARN

These routes document no feature-specific response object properties. Their shared ProblemDetails schema survives. No property is being removed from a surviving request or response. For completeness, the exact registry makes response-required-property-removed ERR and response-optional-property-removed INFO; neither applies to this ticket's scope. Removed whole operations use api-path-removed-with-deprecation or api-removed-with-deprecation, both INFO, after this PR merges. No ignore file or gate configuration changes are included.

The tests read the actual framework-generated OpenAPI shape, for example paths["/api/challenges"]["get"]["deprecated"] = true, observed in both committed artifacts. Re-derive the complete documents with dotnet build Orbit.slnx. A structural comparison against the original documents confirmed exactly 13 added deprecated: true flags per document and equality of every other value, including every schema and route.

Test evidence

Before changing implementation or tests:

dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~ChallengesControllerTests|FullyQualifiedName~AccountabilityControllerTests|FullyQualifiedName~AccountabilityControllerRateLimitTests' --nologo

Exit 0: 26 passed, zero skipped. Existing behavior tests did not check deprecation metadata.

After adding SocialDeprecationTests, with the controllers still unchanged:

dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~SocialDeprecationTests --nologo

Exit 1: all 13 cases failed because each operation lacked deprecated in the original generated document. After adding the annotations and rebuilding:

dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~SocialDeprecationTests|FullyQualifiedName~ChallengesControllerTests|FullyQualifiedName~AccountabilityControllerTests|FullyQualifiedName~AccountabilityControllerRateLimitTests' --nologo

Exit 0: 39 passed, zero skipped. All existing behavior assertions are unchanged.

Final verification after commit, all exit 0:

Command	Result
dotnet build Orbit.slnx --nologo	Zero errors; 19 warnings in unchanged dependency and code paths
Focused command above	39 passed
dotnet test tests/Orbit.Domain.Tests --nologo	736 passed
dotnet test tests/Orbit.Application.Tests --nologo	5,556 passed
dotnet test tests/Orbit.Infrastructure.Tests --nologo	3,692 passed
dotnet test tests/Orbit.Analyzers.Tests --nologo	32 passed

The full solution's four test projects total 10,016 passing tests, zero failures and zero skips. Warnings concern existing NU1608 package constraints, API-versioning configuration, Firebase Message.Token, the subscription deprecation tests and CS9107 in AgentChatWriteHoldTests; this change introduces no new warning sites. The unchanged controller baseline already emitted its dependency and compiler warnings, so a zero-warning build was not observed or claimed.

All commit hooks passed, including formatting, dash, timeless-text and suppression checks. git diff --check passed. No new #pragma, SuppressMessage, narration comments, migration, client changes or server/browser execution.

Follow-up rollout

The removal PR remains gated on the UI part-1 Android build being live in the Play fleet and the carrying MinSupportedVersion floor being enforced. This PR changes metadata only and requires no database migration or version-floor update.

Assumptions

• The final orchestrator instruction defines this PR as deprecation only; rejected the earlier deletion and migration scope for this PR. The follow-up owns deletion, its empty-reference sweep, migration and removal-specific regression cases.
• Request schemas disappear with the retired endpoints in the follow-up; rejected interpreting that as property removal from surviving endpoints, consistent with the ticket's explicit statement that no DTO field is removed.

[pullfrog]

✅ No new issues found.

Reviewed changes All seven changed files were reviewed, including the deprecation annotations, both generated OpenAPI documents, and regression tests.

• Endpoint metadata: All six challenge actions and seven accountability actions are marked obsolete while preserving routes, request/response contracts, authorization, rate limits, and handler behavior.
• Versioned documentation: The existing OpenAPI transformer emits deprecated: true for all 13 operations in both API versions; no other contract changes appear in the diff.
• Regression coverage: The new metadata tests and existing behavior tests remain active. The focused controller, rate-limit, deprecation, and API-versioning suite passed all 52 tests, with zero failures or skips; regenerated OpenAPI files left the worktree clean.
• Rollout boundary: This PR retains the legacy endpoints for installed clients. Actual removal and its Android release/version-floor prerequisites remain explicitly deferred to the follow-up.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
13 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud