Assistant/architecture/architecture-registry.md

4. architecture-registry.yaml

Below is the normative starter registry. It is intentionally small. Tooling may extend the schema, but new relation types must have an enforcement/use case.

registry_version: 1
semantic_generation: 1
architecture_generation: 1

modules:
  identity:
    id: mod.identity
    owns: [Identity, Actor, PrincipalBinding]
    database_schema: identity
    boundary_class: remote_capable
    may_depend_on: [platform.ids, platform.events]
    forbidden: [adapters.models, adapters.temporal]

  authority:
    id: mod.authority
    owns: [Scope, AuthorityGrant, AuthorityValidation]
    database_schema: authority
    boundary_class: remote_capable
    may_depend_on: [contracts.identity, platform.ids, platform.events]

  situation:
    id: mod.situation
    owns: [Situation, FocusBinding, ProjectRegistry, ActiveProjectFocus]
    database_schema: situation
    boundary_class: remote_capable
    may_depend_on: [contracts.identity, contracts.authority, contracts.work, contracts.capability]

  work:
    id: mod.work
    owns: [Goal, HelpPath, GoalLifecycle, Task, Decision, PlanCandidate, WorkPlan, PlanStep, CapabilityRequirement, DelegationCandidate, Delegation, AgentRun, AgentCheckpoint, AgentResult, DelegationVerification]
    database_schema: work
    boundary_class: remote_capable
    may_depend_on: [contracts.identity, contracts.authority, contracts.epistemics, contracts.capability, platform.ids, platform.events]

  epistemics:
    id: mod.epistemics
    owns: [Observation, Claim, Belief, Provenance]
    database_schema: epistemics
    boundary_class: remote_capable
    may_depend_on: [contracts.identity, contracts.artifact, platform.events]

  continuity:
    id: mod.continuity
    owns: [Commitment, ProspectiveItem]
    database_schema: continuity
    boundary_class: remote_capable
    may_depend_on: [contracts.work, contracts.identity, contracts.authority, platform.events]

  capability:
    id: mod.capability
    owns: [Capability, CapabilityBinding, CapabilityHealth, CapabilityImplementation, CapabilityResolution, CapabilitySelection, CapabilityGap, AcquisitionStrategyCandidate, CapabilityUsageObservation, SkillProfile, SkillEvidence, FastPathDecision]
    database_schema: capability
    boundary_class: remote_capable
    may_depend_on: [contracts.identity, contracts.authority, contracts.artifact]

  commit:
    id: mod.commit
    owns: [ActionProposalRecord, AuthorizedAction, ActionAttemptRecord]
    database_schema: commit
    boundary_class: remote_capable
    may_depend_on: [contracts.authority, contracts.capability, contracts.work, platform.events]
    privileged: true

  artifact:
    id: mod.artifact
    owns: [ArtifactMetadata, ArtifactLineage]
    database_schema: artifact
    boundary_class: remote_capable
    may_depend_on: [contracts.identity]

platform:
  allowed_packages:
    - platform.ids
    - platform.clock
    - platform.outbox
    - platform.inbox
    - platform.telemetry
    - platform.errors
    - platform.secrets
  rule: "platform owns mechanisms, never domain meaning"

runtime_topology_v1:
  core_runtime:
    modules: [identity, situation, work, epistemics, capability, artifact, interaction]
  continuity_runtime:
    modules: [continuity]
  commit_runtime:
    modules: [authority, commit]
    isolation_reason: [secrets, external_mutation_authority, failure_isolation]
  cognitive_workers:
    modules: []
    role: "replaceable cognition/context compilation workers; no canonical ownership"

storage_topology_v1:
  postgres_cluster: assistant_primary
  schemas:
    identity: identity_role
    authority: authority_role
    situation: situation_role
    work: work_role
    epistemics: epistemics_role
    continuity: continuity_role
    capability: capability_role
    commit: commit_role
    artifact: artifact_role
    interaction: interaction_role
  cross_owner_fk: forbidden_by_default
  cross_owner_write: forbidden
  cross_owner_application_join: forbidden

invariants:
  - id: INV-AUTH-001
    property: "No external mutation without current valid authority and target/revision checks"
    class: HARD
    enforcement: [commit_runtime, property_tests, secret_acl]
  - id: INV-OWN-001
    property: "Only semantic owner writes canonical state"
    class: HARD
    enforcement: [db_acl, architecture_linter]
  - id: INV-CONT-001
    property: "Future obligations survive workflow engine loss"
    class: HARD
    enforcement: [canonical_prospective_store, recovery_test]
  - id: INV-TOPO-001
    property: "Major bounded contracts preserve semantics across inproc and remote topology"
    class: HARD
    enforcement: [topology_equivalence_tests]
  - id: INV-EPI-001
    property: "Model output cannot directly become canonical fact/action"
    class: HARD
    enforcement: [package_boundaries, commit_apis, semantic_validation_tests]
  - id: INV-PROJ-001
    property: "Projection eventually converges from canonical state"
    class: CONVERGENCE
    enforcement: [projection_rebuild_tests, lag_metrics]

protected_paths:
  - architecture/ARCHITECTURE_CONSTITUTION.md
  - architecture/architecture-registry.yaml
  - architecture/adrs/**
  - ci/architecture/**
  - .gitea/workflows/ci.yml
  - cmd/devctl/**
  - dev/ACTIVE_TASK.json
  - ci/architecture/**
  - security/**

default_feature_task_authority:
  may_write: ["declared module paths", "module-owned tests"]
  may_not_change:
    - canonical_ownership
    - public_cross_module_contracts
    - protected_paths
    - third_party_dependencies
    - database_owner_roles
    - privileged_capabilities

4.1 Registry enforcement required before large Codex implementation

Minimum deterministic checks:

1. Go import graph against may_depend_on/forbidden edges.
2. No /modules/*/domain imports from adapters/runtime/provider packages.
3. Migration scanner rejects cross-owner writes/FKs/triggers/views unless explicit approved exception.
4. PostgreSQL role tests prove owner isolation.
5. Diff-scope check against Codex Task Packet.
6. Protected-path rule.
7. Public contract change detection.
8. Required CI guardrail health: missing checker result is failure, not pass.