Submit policy version for review
Transitions a draft policy version to “submitted” state. Requires the actor to be the draft author. Blocks if another draft or submitted version exists for the same policy. The request body is intentionally omitted from the schema so callers may invoke this endpoint with no body (Fastify rejects undefined bodies when a body schema is attached).
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Response
Default Response
x >= 0SHA-256 hex of projectActiveRules(rules) — the same projection and hash the review-submission seal's active_rules_hash and the ratification receipt's policy_rules_hash use. Compare against a sealed subject's active_rules_hash to tell whether the ACTIVE RULES' EVALUATED CONTENT (code/condition/severity/when, in stored order) is unchanged since that seal — not whether the rule objects as a whole (name, description, source_ref, an added inactive rule) are unchanged.
^[0-9a-f]{64}$Lifecycle status: draft → submitted → ratified → (activated, then) superseded (or back to draft on reject); discarded = soft-discarded draft (PWB-039). A pending version that ends without governing is closed: reopened (a ratified version whose content continues as a new draft), set_aside (put aside with a reason), replaced (a draft whose correction continues as a new draft) — PAL-004/005.
draft Present only on a version created by draft supersession: the id of the replaced draft this version continues. Written when the version is created and never changed. Absent on every other version, including one started after a set-aside or a reopen.
What the codification that produced this version accounted for. Unsigned and unhashed; NOT a sealed review package.