rApp safeguards

All keyed on the rApp's OAuth client id and applied when an rApp creates a config job (POST /ran-nf-oam/config-jobs). Rollbacks and automatic reverts are never limited, because undoing must not be refused.

Limits in the manifest

limits:
  configJobsPerHour: 20
  maxElementsPerJob: 50
  maxChangePercent: 25

Limit	Refusal
configJobsPerHour (1 to 100000)	429 RAPP_RATE_LIMITED, with Retry-After
maxElementsPerJob: managed elements one job may touch	403 RAPP_BLAST_RADIUS_EXCEEDED
maxChangePercent: how far a numeric value may move in one write, as a percent of its current value	403 RAPP_MAGNITUDE_EXCEEDED

rApp Management pushes the limits to RAN NF OAM when an instance finishes bootstrapping (PUT /rapp-limits/{invokerId}; a repeat replaces the whole set). Magnitude reads the current value from the network function; a value that cannot be read, or is not a number, is refused. Operators can read and change limits; an rApp cannot change its own (403 RAPP_LIMIT_SELF_CHANGE).

Kill switch

PUT /ran-nf-oam/rapp-kill/{invokerId} (requestedBy, reason) stops an rApp. RAN NF OAM refuses its config jobs at once (403 RAPP_KILLED, dry runs too) and a waiting job does not continue; since 0.3.0 the gateway also refuses every other change the rApp makes, and every change an SMO module makes on its behalf, within a few seconds (it re-reads the switch every R1_KILL_CACHE_SECONDS, default 3). Left open so it can be wound down: reads, deleting what it made, getting a token, and rolling back its own config job. Halt, abort and rollback of a job still work. If the gateway cannot read the switch it refuses the change (503 KILL_SWITCH_UNAVAILABLE). DELETE lifts it; GET /rapp-kill reads it. rApp Management offers it per instance: PUT/DELETE /rapp-mgmt/instances/{id}/kill, and the operator GUI's Safeguards page has a Stop button.

Events for refusals

Every refusal is recorded (GET /ran-nf-oam/safeguard-refusals, filters invoker_id, code, since) and announced through the outbox to each subscriber of POST /ran-nf-oam/safeguard-subscriptions. Event: RAPP_SAFEGUARD_REFUSAL with refusal, invokerId, requestedBy, detail, occurredAt. The same refusal of the same rApp is announced once per SAFEGUARD_EVENT_MIN_INTERVAL_SECONDS (default 60; 0 announces all), but every one is recorded.

These routes are internal-only at the gateway: an rApp cannot stop, limit or watch another rApp.