Strategy internal API

Rolling out

These routes ship with the strategy workspace, which is being rolled out now.

Internal only

Reached only through the backend: the browser calls /launch/strategy/* (client) or /system/launch/:orgId/strategy/* (staff). Internally they mount at /internal/launch/strategy (org scope) and /internal/system/launches/:orgId/strategy (system scope), with the same handlers in both.

Method & path	Purpose	Permission
GET /	The strategy: head, current draft, approved version, notices	strategy.read
POST /start	Start a strategy (prefilled from business identity)	strategy.write
PUT /steps/:step	Save one step's answer	strategy.write
POST /steps/:step/suggestions	AI suggestions for a step (fair-use limited)	strategy.write
POST /fields/confirm	Confirm or change AI assumptions and account-manager fields	strategy.write, org only
POST /competitors/lookup	Competitor search by category and area (daily cap)	strategy.write
POST /help	Ask for a Spark account manager	strategy.write
PUT /notes	Staff notes, never shown to the client	system only
POST /approve	Approve the draft, bound to its content hash	strategy.approve, org only
POST /withdraw	Withdraw the approval	strategy.approve, org only
POST /draft	Open a new draft from the approved version	strategy.write
GET /versions · GET /versions/:n	Version list · one version	strategy.read
GET /diff	What changed between two versions	strategy.read
GET /monitor	Goal, KPI rows and open recommendations	strategy.read
POST /recommendations/:id/dismiss	Dismiss a recommendation with a reason	strategy.write
POST /review/start	Start the monthly review (opens a draft)	strategy.write

Org only routes refuse staff tokens with 403 client_only: staff carry every permission, so this guard is what keeps confirmation and approval with the client. System scope passes the permission checks, so staff and account managers can open and edit drafts.

Approve answers, in guard order: not_draft, steps_incomplete, steps_stale, assumptions_unconfirmed, approval_stale.