# Metadata authoring: current owners and legacy retirement

Status: current boundary for #4694. This document distinguishes reachable
production owners from retained setup mechanisms and historical route adapters.
It does not claim that the remaining authoring workflows have shipped.

## Production paths

- Runtime API and Runtime Worker are composed by `backend/internal/runtimeproduction`
  and `backend/internal/runtimeworker`. Their command dependency closures must
  exclude `backend/pkg/serverruntime`, `application/services`, and L1. The guard
  is `scripts/ci/check-runtime-process-boundary.sh`.
- L1 AppService owns Salesforce routes and wire projection. Metadata AdminRead
  is read-only. An internal MetadataService write method is not a reachable
  serviceified authoring capability.
- Layout V2, application navigation, and PermissionAuthoring have dedicated
  owners. Schema authoring must not recreate their writes. See
  [Layout's current domain](layout-authoring-runtime-domain.md).
- Execution MetadataService uses an immutable request-bound view. Administration
  reads may observe persisted metadata independently; their success does not
  prove that Records or a worker adopted a newly authored definition.

Online authoring must follow the
[configuration lifecycle boundary](configuration-and-execution-lifecycle.md).
The execution view described above is current coupling, not a requirement to
publish Catalog after an admin save. Its replacement must cover the actual
API/worker consumers without creating a live/Catalog fallback.

## Retired serving entry

`backend/pkg/serverruntime/routes.go` had no caller after the runnable monolith
entry points were removed. Its route composition, receipt-router startup wrapper,
and version-discovery wrappers are now removed. The monolith retirement test
forbids restoring this file. Shared engines, API-host implementations, and
Connectors implementations are not retired by this change.

Tests that inspected the removed route source, its private discovery helper, or
its historical registration inventory were removed with it. Their old admission
assumptions must not be projected onto the current topology:

- Runtime's `security_admission_test.go` exercises delegated identity, current
  permission authority, auth epochs, and fail-closed admission before handlers.
- The pinned API-host Gateway tests reject HTTP Upgrade before upstream calls
  and admission. Retiring the old WebSocket-construction assertion does not
  enable WebSocket serving.
- The provider-neutral ingress scan now covers the production Integration
  service, while the existing pinned Connectors gate/dispatcher and CSRF checks
  retain their independent scope.

The [browser/programmatic split proposal](browser-programmatic-auth-context-split.md)
retains historical security rationale; its monolith consumer map is not a
current production inventory.

## Retained consumers and follow-up boundaries

Setup still imports serverruntime. `controlplane_service_graph.go` binds the
Controlplane ServiceGraph to ServiceManager, and connector identity recovery
also constructs this graph. Keep these headless consumers until an independently
verified replacement switches them and removes the old composition together.

ProductHooks route declarations and their helpers remain separate cleanup work:
they are still composed by CRM setup and referenced by tests. Their execution
entry is retired, but deleting their types and callbacks requires its own
consumer closure. Published Contract/API-host surfaces similarly require a
supported-version disposition before deletion.

The next functional proof is object -> ordinary field -> permission grant ->
record create/query/update -> restart/read-back, including a second API and a
worker. It must settle durable operation results, DDL recovery, definition
adoption, and companion-effect ownership. The existing runtime L1 walking-slice
script proves separate-process record/query consumption; it does not yet prove
administrator schema authoring. No generic mutation dispatcher or database
fallback is authorized by this roadmap.