Public dry run dryrun-00a47f2c6f21

Source commit: 00a47f2c6f213d43fcef11fdf7926320241da30d

Public tree identity: sha256:c41c788b9938cfa66d0c047c16729942bfe6ba4f884acec7d4cd482da762f81a

scripts/cli-first-contract-smoke.js

@@ -107,6 +107,7 @@ for (const [name, pattern] of [
   ["CLI human output coverage", /fn human_report_is_text_not_json\(\)/],
   ["CLI key lifecycle coverage", /fn key_lifecycle_reports_project_scoped_agent_credentials\(\)/],
   ["CLI node revoke coverage", /fn node_revoke_reports_scoped_credential_revocation\(\)/],
+  ["CLI admin public API coverage", /fn admin_status_and_suspend_use_public_coordinator_api\(\)/],
   ["doctor unchecked reachability coverage", /fn doctor_reports_unchecked_coordinator_reachability_without_config\(\)/],
   ["doctor ping reachability coverage", /fn doctor_pings_configured_coordinator\(\)/],
   ["project local config coverage", /fn project_init_select_and_status_use_local_project_config\(\)/],
@@ -143,6 +144,11 @@ expect(
   "coordinator node revoke coverage",
   /fn service_revokes_node_credentials_and_live_descriptors\(\)/
 );
+expect(
+  coordinator,
+  "coordinator public admin suspension coverage",
+  /fn service_reports_and_enforces_public_admin_tenant_suspension\(\)/
+);
 
 for (const [name, pattern] of [
   ["agent --json flag", /struct AgentEnrollArgs[\s\S]*#\[arg\(long\)\]\s*json: bool/],

scripts/user-session-token-boundary-smoke.js

@@ -45,6 +45,8 @@ function assertNoUserSessionCredential(surface, text) {
 
 const coordinatorService = read("crates/disasmer-coordinator/src/service.rs");
 for (const variant of [
+  "AdminStatus",
+  "SuspendTenant",
   "AttachNode",
   "RegisterAgentPublicKey",
   "ListAgentPublicKeys",