Check the gate

GET /v1/ci/gate requires read scope.

Acknowledge a signal

POST /v1/signals/{signal_id}/acknowledge requires write scope.
Acknowledgement is tenant-scoped and idempotent at the service boundary. It does not change the signal’s verification state or evidence.