feat: implement Foundation V1 walking skeleton

modules/commit/README.arch.md

@@ -0,0 +1,7 @@
+# commit
+
+**Owns:** Action proposal, authorization/commit protocol and attempt records.
+
+See `architecture/architecture-registry.yaml` for allowed dependencies and DB schema.
+
+This module may not write another owner's canonical state. Domain code does not import adapters/runtime/providers.

modules/commit/application/doc.go

@@ -0,0 +1,3 @@
+package application
+
+// Package application coordinates commit-owned use cases through explicit ports.

modules/commit/domain/commit.go

@@ -0,0 +1,78 @@
+package domain
+
+import (
+	"errors"
+
+	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/capability"
+	commitcontract "git.cin.su/m/Assistant/contracts/commit"
+	"git.cin.su/m/Assistant/modules/commit/ports"
+)
+
+var (
+	ErrInvalidProposal       = errors.New("action proposal lacks target, revision, capability, or operation")
+	ErrUnknownOutcome        = errors.New("unknown outcome requires reconciliation before retry")
+	ErrInvalidReconciliation = errors.New("reconciliation requires the matching UNKNOWN_OUTCOME attempt and a new attempt identity")
+)
+
+type AuthorizationContext = authority.AuthorizationContext
+
+// Reconcile verifies an UNKNOWN_OUTCOME through a read-only external query.
+// It never invokes Executor.Execute and therefore cannot repeat the effect.
+func Reconcile(action commitcontract.AuthorizedAction, previous commitcontract.ActionAttempt, attemptID commitcontract.ActionAttemptID, reconciler ports.Reconciler) (commitcontract.ActionAttempt, error) {
+	if action.State != commitcontract.ActionAuthorized || previous.State != commitcontract.ActionUnknownOutcome ||
+		previous.AuthorizedID != action.ID || previous.IntentID != action.Proposal.IntentID || attemptID == "" || attemptID == previous.ID {
+		return commitcontract.ActionAttempt{}, ErrInvalidReconciliation
+	}
+	attempt := commitcontract.ActionAttempt{ID: attemptID, AuthorizedID: action.ID, IntentID: action.Proposal.IntentID, State: commitcontract.ActionExecuting}
+	result := reconciler.Reconcile(action)
+	if !result.Known {
+		attempt.State = commitcontract.ActionUnknownOutcome
+		return attempt, ErrUnknownOutcome
+	}
+	if result.Succeeded {
+		attempt.State = commitcontract.ActionSucceeded
+		return attempt, nil
+	}
+	attempt.State = commitcontract.ActionFailed
+	return attempt, nil
+}
+
+// Authorize is the Commit boundary. A proposal alone never reaches Executor.
+func Authorize(proposal commitcontract.ActionProposal, context AuthorizationContext, validator ports.AuthorityValidator, authorizedID commitcontract.AuthorizedActionID) (commitcontract.AuthorizedAction, error) {
+	if proposal.IntentID == "" || proposal.ActorID == "" || proposal.CapabilityID == capability.CapabilityID("") ||
+		proposal.Target.TaskID == "" || proposal.Target.GoalID == "" || proposal.Target.ScopeID == "" || proposal.Target.Revision == 0 || proposal.Operation == "" {
+		return commitcontract.AuthorizedAction{}, ErrInvalidProposal
+	}
+	if proposal.ActorID != context.Binding.ActorID || proposal.Target.ScopeID != context.Scope.ID {
+		return commitcontract.AuthorizedAction{}, ErrInvalidProposal
+	}
+	if err := validator.Validate(context); err != nil {
+		return commitcontract.AuthorizedAction{}, err
+	}
+	if authorizedID == "" {
+		return commitcontract.AuthorizedAction{}, ErrInvalidProposal
+	}
+	proposal.State = commitcontract.ActionProposed
+	return commitcontract.AuthorizedAction{ID: authorizedID, Proposal: proposal, GrantID: context.Grant.ID, ScopeID: context.Scope.ID, State: commitcontract.ActionAuthorized}, nil
+}
+
+// Execute records UNKNOWN_OUTCOME rather than silently retrying an ambiguous
+// external mutation.
+func Execute(action commitcontract.AuthorizedAction, attemptID commitcontract.ActionAttemptID, executor ports.Executor) (commitcontract.ActionAttempt, error) {
+	if action.State != commitcontract.ActionAuthorized || attemptID == "" {
+		return commitcontract.ActionAttempt{}, ErrUnknownOutcome
+	}
+	attempt := commitcontract.ActionAttempt{ID: attemptID, AuthorizedID: action.ID, IntentID: action.Proposal.IntentID, State: commitcontract.ActionExecuting}
+	result := executor.Execute(action)
+	if !result.Known {
+		attempt.State = commitcontract.ActionUnknownOutcome
+		return attempt, ErrUnknownOutcome
+	}
+	if result.Succeeded {
+		attempt.State = commitcontract.ActionSucceeded
+		return attempt, nil
+	}
+	attempt.State = commitcontract.ActionFailed
+	return attempt, nil
+}

modules/commit/domain/doc.go

@@ -0,0 +1,3 @@
+package domain
+
+// Package domain contains commit domain meaning only. It must not import adapters or runtime packages.

modules/commit/module.go

@@ -0,0 +1,4 @@
+package commit
+
+// Module is an intentionally minimal V1 composition handle. Do not turn it into a God service.
+type Module struct{}

modules/commit/ports/doc.go

@@ -0,0 +1,3 @@
+package ports
+
+// Package ports declares commit-owned external dependencies. Ports must be narrow and semantic.

modules/commit/ports/executor.go

@@ -0,0 +1,27 @@
+package ports
+
+import (
+	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/commit"
+)
+
+// Executor is the only commit-owned port permitted to reach an external world.
+// Its implementation belongs in an isolated adapter/runtime, never in domain.
+type Executor interface {
+	Execute(commit.AuthorizedAction) ExecutionResult
+}
+
+// Reconciler verifies an ambiguous effect without applying it again.
+type Reconciler interface {
+	Reconcile(commit.AuthorizedAction) ExecutionResult
+}
+
+type ExecutionResult struct {
+	Succeeded bool
+	Known     bool
+}
+
+// AuthorityValidator is the remote-capable boundary to the Authority owner.
+type AuthorityValidator interface {
+	Validate(authority.AuthorizationContext) error
+}