Freeze the three fact events, intentflow allowlist, and plan table ownership so later units cannot invent producers or write paths outside app/intentflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Composition roots already hold Snapshot ports; the interface and archtest now forbid putting Pool/DocGov/DocRevision/ContextManager/CAS/ProjectWorkflow/FreeformDoc/KB back on Service.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP adapters now reuse the composition-root instance. Candidate-ready, downstream impact, and approved envelopes share the domain unit of work, and missing env/project fail closed without defaulting to dev/0.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give each document command one postgres transaction and only let table owners unwrap the scope, so cross-owner writes can roll back together.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace whole-repo grep with four production-only gates so Goose and tests stop looking like writer debt, and so new SQL, path, or event crossings fail immediately.
Co-authored-by: Cursor <cursoragent@cursor.com>
