[AZ-794] [AZ-795] [AZ-796] Adopt cycle 7 tasks (API quality follow-up)

Adopt three Jira tickets originally filed by gps-denied-onboard
AZ-777 Phase 1 Jetson probing into satellite-provider cycle 7.

- AZ-794: rename inventory body fields tileZoom/tileX/tileY → z/x/y
  (OSM convention; aligns body shape with URL slippy-map convention).
- AZ-795: epic + shared infra ship for strict input validation across
  all public endpoints (FluentValidation + global ProblemDetails
  filter + JsonSerializerOptions.UnmappedMemberHandling.Disallow).
- AZ-796: first concrete per-endpoint child of AZ-795 — strict
  validation for POST /api/satellite/tiles/inventory; reference
  implementation pattern for sibling per-endpoint tasks.

Re-labels the cross-repo follow-up section in _dependencies_table.md
as Step 9 cycle 7, sets cycle 7 ordering (shared infra → rename →
inventory validator), and bumps the autodev state cursor to Step 10
(Implement) for cycle 7.

Source: gps-denied-onboard AZ-777 Phase 1 Jetson probe (2026-05-22).
Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_tasks/_dependencies_table.md

@@ -112,6 +112,21 @@ Source: cycle-5 retro Action 2 — AZ-505 is the deferred half of AZ-503 (invent
 |------|-------|-----------|--------|--------|
 | AZ-505 | Tile inventory endpoint + HTTP/2 + leaflet covering index | AZ-503 (HARD, Blocks-linked, satisfied by cycle 5) | 3 | To Do (cycle 6) |
 
+### Step 9 cycle 7 — New Task: API quality follow-up (cross-repo from gps-denied-onboard AZ-777)
+
+Source: cycle-7 New Task adoption of three Jira tickets originally filed on 2026-05-22 by the `gps-denied-onboard` agent during AZ-777 Phase 1 Jetson probing of the parent-suite `satellite-provider` service. Two API-quality concerns about the inventory endpoint were surfaced:
+
+1. **Field-name inconsistency** — URL path uses OSM-standard `z/x/y`; JSON body uses verbose `tileZoom/tileX/tileY` for the same concept (AZ-794).
+2. **Permissive parsing** — missing required fields silently coerce to `0`; unknown fields silently drop. Real client typos masquerade as valid (0,0,0) requests with collision-prone `locationHash` (AZ-795 epic + AZ-796 first child).
+
+Adopted into satellite-provider cycle 7 with the recommended ordering: shared validation infra (AZ-795) → wire-format rename (AZ-794) → first per-endpoint validator child (AZ-796). AZ-795 is structured as an Epic that ALSO ships shared infrastructure (FluentValidation + global ProblemDetails filter + `JsonSerializerOptions.UnmappedMemberHandling.Disallow`); future per-endpoint child tasks under AZ-795 to be added by parent-suite team as the public-endpoint surface is enumerated.
+
+| Task | Title | Depends On | Points | Status |
+|------|-------|-----------|--------|--------|
+| AZ-794 | Inventory body fields: rename `tileZoom/tileX/tileY` → `z/x/y` (OSM convention) | — (coordinate release with AZ-795 / AZ-796) | 3 | To Do (cycle 7) |
+| AZ-795 | Strict input validation across all public endpoints (FluentValidation + ProblemDetails) — **Epic with shared-infra ship** | — (children gated on shared infra landing first) | — (epic; shared-infra estimate 5–8 pts; per-endpoint children ~3 pts each) | To Do (cycle 7) |
+| AZ-796 | Strict validation for inventory endpoint (POST /api/satellite/tiles/inventory) | AZ-795 (HARD — shared infra); coordinate with AZ-794 | 3 | To Do (cycle 7) |
+
 ## Execution Order
 
 ### Step 6
@@ -169,6 +184,15 @@ Single task; consumes the AZ-503-foundation columns landed in cycle 5.
 
 1. AZ-505 (3 SP) — Tile inventory endpoint + HTTP/2 + Leaflet covering index. Self-contained but produces TWO contract artifacts (new `contracts/api/tile-inventory.md` v1.0.0 + bump `contracts/data-access/tile-storage.md` v1.0.0 → v2.0.0 per architecture.md).
 
+### Step 9 cycle 7 (AZ-794 / AZ-795 / AZ-796)
+
+Adopted into cycle 7. Ordering:
+
+1. AZ-795 shared infrastructure (FluentValidation + global ProblemDetails filter + `JsonSerializerOptions.UnmappedMemberHandling.Disallow`) — gates every per-endpoint child.
+2. AZ-794 (rename) — lands the final wire-format names so AZ-796 validators can use them from day one.
+3. AZ-796 (inventory validator) — first per-endpoint child; serves as reference implementation for sibling per-endpoint child tasks.
+4. Sibling per-endpoint child tasks under AZ-795 — added by parent-suite team as they enumerate the surface from `/swagger/v1/swagger.json` (out of cycle 7 scope; future cycles).
+
 ## Total Effort
 
 Step 6: 6 tasks, 17 story points
@@ -180,6 +204,7 @@ Step 9 cycle 3: 6 tasks created (AZ-491 = 3 pts, AZ-492 = 3 pts, AZ-493 = 2 pts,
 Step 9 cycle 4: 1 task created (AZ-500 = 5 pts)
 Step 9 cycle 5: 3 tasks tracked (AZ-503 = 3 pts foundation-half, AZ-504 = 1 pt, AZ-505 = 3 pts split-off-deferred) — 4 pts committed to cycle 5, 3 pts deferred to cycle 6
 Step 9 cycle 6: 1 task scheduled (AZ-505 = 3 pts) — consumed from cycle-5 deferral
+Step 9 cycle 7: 3 tasks adopted (AZ-794 = 3 pts rename, AZ-795 = epic with 5–8 pts shared-infra ship, AZ-796 = 3 pts first per-endpoint child) — total ~11–14 pts (over the 2–5 pts/cycle preference; AZ-795's shared-infra ship is the heavy item). Origin: gps-denied-onboard AZ-777 Phase 1 Jetson probe (2026-05-22). Sibling per-endpoint child tasks under AZ-795 to be added in future cycles as the parent-suite team enumerates the endpoint surface.
 
 ## Coverage Verification
 

_docs/_autodev_state.md

@@ -2,12 +2,12 @@
 
 ## Current Step
 flow: existing-code
-step: 9
-name: New Task
+step: 10
+name: Implement
 status: in_progress
 sub_step:
-  phase: 1
-  name: gather-feature-description
+  phase: 0
+  name: awaiting-invocation
   detail: ""
 retry_count: 0
 cycle: 7