Composition roots already hold Snapshot ports; the interface and archtest now forbid putting Pool/DocGov/DocRevision/ContextManager/CAS/ProjectWorkflow/FreeformDoc/KB back on Service.
Co-authored-by: Cursor <cursoragent@cursor.com>
Coordinator now takes a StageTaskRunner and injected context/KB ports.
Chatflow assembler reads maturity tokens instead of the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
Intent only needed the three official stage tokens. Moving them to a
leaf package lets the recognizer compile without the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
docgov saves content hashes through the new leaf module so it no longer
imports docrevision. Existing docrevision exports stay as thin wrappers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep OnOutbox and approval hooks registered while dispatcher mode is
off, but no-op them as soon as the matching durable consumer owns the
visible write so a later switch cannot dual-write.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP Runtime does not start the worker. Each compose environment gets its own events service, health port, and bounded pool.
Co-authored-by: Cursor <cursoragent@cursor.com>
Workers claim with SKIP LOCKED, heartbeat by token, and ack/fail only when the fencing token still matches. Shadow scans without acking live deliveries.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0B needs an additive lease audit trail and a cluster-level off/shadow/live table before any worker can claim. FAV remains constrained to off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive isolated-PG evidence, 7-day read-only inventory, and the decision to bootstrap consumers from the first safe event instead of gap-waiting.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP adapters now reuse the composition-root instance. Candidate-ready, downstream impact, and approved envelopes share the domain unit of work, and missing env/project fail closed without defaulting to dev/0.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject empty environment/project, disable FAV consumers at register time, and keep historical classification/repair/replay as audited application use cases with no raw SQL entrypoint.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0A needs additive tables for classification and per-consumer identities before any dispatcher can claim work. FAV principals are rejected at the schema check.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move the reviewed durable-event, HTTP envelope, and PI typed-result
designs off the docs/ prefix so Track E can start from latest dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen