{ "schema": "nexuscrm.runtime-metadata-closure.p7a/v2", "evidence_revision": "41061972fa7796e1d763f9e1737bb500fd39f3b8", "alignment_revision": "92702c5cec8fdb751994dfd1023403120806bdf6", "scope": { "production_candidate_entrypoint": "backend/internal/runtimeapi.AssembleProduction", "serving_operations": [ "backend/internal/runtimeapi.RecordsServer.EvaluateRecordAccess", "backend/internal/runtimeapi.RecordsServer.ReadSelectedRoot" ], "current_independent_capabilities": [ "runtime.records.evaluate-access.v1", "runtime.records.read-selected-root.v1" ], "c0_first_production_route": "POST /services/data/:version/ui-api/record-access", "c0_capability_in_current_independent_closure": true, "current_command_entrypoint": "backend/internal/runtimeapi.AssembleNonServingBootstrap", "current_command_serves": false, "legacy_monolith_included": false }, "classifications": [ "runtime_metadata_view_required", "security_authoritative_not_ordinary_metadata", "derived_from_bound_view", "legacy_fallback_to_delete", "outside_independent_runtime_closure" ], "composition_root_calls": [ { "call": "connection.DB", "count": 1 }, { "call": "persistence.NewMetadataRepository", "count": 1 }, { "call": "persistence.NewPermissionRepository", "count": 1 }, { "call": "persistence.NewUserRepository", "count": 1 }, { "call": "persistence.NewQueryRepository", "count": 1 }, { "call": "persistence.NewRecordRepository", "count": 1 }, { "call": "errors.New", "count": 2 }, { "call": "logging.InitLogger", "count": 1 }, { "call": "context.Background", "count": 1 }, { "call": "logging.New", "count": 1 }, { "call": "metadata.NewMetadataService", "count": 1 }, { "call": "permissions.NewPermissionService", "count": 1 }, { "call": "permissions.NewFolderAccessService", "count": 1 }, { "call": "permissionService.SetFolderAccess", "count": 1 }, { "call": "metadataService.SetListViewRLSProvider", "count": 1 }, { "call": "metadataService.RegisterSchemaDecorator", "count": 3 }, { "call": "permissions.NewSchemaDecorator", "count": 1 }, { "call": "metadata.NewCompoundVirtualFieldDecorator", "count": 1 }, { "call": "metadata.PlatformCompoundVirtualFieldDeclarations", "count": 1 }, { "call": "metadata.NewServerDefaultedFieldsDecorator", "count": 1 }, { "call": "metadata.PlatformServerDefaultedFieldDeclarations", "count": 1 }, { "call": "analytics.NewFormulaViewService", "count": 1 }, { "call": "queryRepo.SetViewResolver", "count": 1 }, { "call": "recordRepo.SetViewResolver", "count": 1 }, { "call": "recordRepo.SetSchemaProvider", "count": 1 }, { "call": "analytics.NewQueryService", "count": 1 }, { "call": "records.NewPersistenceService", "count": 1 }, { "call": "metadata.NewValidationService", "count": 1 }, { "call": "formula.NewEngine", "count": 1 }, { "call": "persistenceService.SetSelectedRootProjectionReader", "count": 1 }, { "call": "records.NewContractService", "count": 1 }, { "call": "r.Metadata.RefreshCache", "count": 1 }, { "call": "r.Permissions.RefreshPermissions", "count": 1 } ], "production_assembler_calls": [ { "call": "database.NewConnection", "count": 1 }, { "call": "runtimeassembly.BuildRecordsReadDependencies", "count": 1 }, { "call": "runtimeassembly.NewRecordsReadRuntime", "count": 1 }, { "call": "connection.Close", "count": 3 }, { "call": "graph.Prepare", "count": 1 }, { "call": "Assemble", "count": 1 } ], "read_paths": [ { "id": "startup-effective-schemas", "phase": "startup", "owner": "Catalog metadata repository", "accessor": "MetadataRepository.GetAllSchemas", "classification": "runtime_metadata_view_required", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "schemas, err := ms.repo.GetAllSchemas(ctx)", "note": "Loads the complete ObjectMetadata and FieldMetadata set used by selected-root, permission policy, RLS, storage mapping, and hydration." }, { "id": "startup-permission-catalog-decoration", "phase": "startup", "owner": "System permission catalog", "accessor": "PermissionService.ListSystemPermissions", "classification": "runtime_metadata_view_required", "source_file": "nexuscrm-permissions/schema_decorator.go", "source_anchor": "catalog, err := d.catalog.ListSystemPermissions(ctx)", "note": "Compiler input for the effective PermissionSet virtual-field surface; per-user grants remain security-authoritative. The current decorator degrades to the undecorated schema when this read fails." }, { "id": "startup-effective-relationships", "phase": "startup", "owner": "Catalog metadata repository", "accessor": "MetadataRepository.GetAllRelationships", "classification": "runtime_metadata_view_required", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "explicitRelationships, err := ms.repo.GetAllRelationships(ctx)", "note": "Explicit rows are combined with field-declared relationships; sharing-parent resolution consumes the effective graph." }, { "id": "startup-flow-overfetch", "phase": "startup", "owner": "Catalog metadata repository", "accessor": "MetadataRepository.GetAllFlowDefinitions", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "flowDefs, err := ms.repo.GetAllFlowDefinitions(ctx)", "note": "RefreshCache makes selected-root readiness depend on flow loading although the operation never reads flows." }, { "id": "startup-validation-overfetch", "phase": "startup", "owner": "Catalog metadata repository", "accessor": "MetadataRepository.GetAllValidationRules", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "allRules, err := ms.repo.GetAllValidationRules(ctx)", "note": "Loaded by the broad cache refresh but not read by selected-root." }, { "id": "startup-role-hierarchy", "phase": "startup_and_ttl_refresh", "owner": "Runtime permission authority", "accessor": "PermissionRepository.GetAllRoles", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/role_hierarchy.go", "source_anchor": "roles, err := ps.repo.GetAllRoles(ctx)", "note": "Stored in a process-global 60-second TTL cache and used by hierarchical RLS. It must remain SecurityEpoch-compatible rather than enter CatalogSnapshot." }, { "id": "startup-formula-function-registry", "phase": "startup", "owner": "Process formula runtime", "accessor": "formula.ActiveRuntimeExecutableFunctionRegistry", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-analytics/formula_view_service.go", "source_anchor": "registry, err := formula.ActiveRuntimeExecutableFunctionRegistry()", "note": "The constructor reads it, but selected-root ResolveTableName does not consult the copied registry." }, { "id": "request-current-core-pointer", "phase": "request", "owner": "Process-global MetadataService", "accessor": "MetadataService.GetSchema/GetSchemas/GetRelationships", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "func (ms *MetadataService) loadCoreCache() *metadataSnapshot {", "note": "Each accessor independently loads the current atomic pointer, so one request can observe different generations. The Runtime edge to this accessor must become unreachable at cutover." }, { "id": "request-schema-repository-miss", "phase": "request", "owner": "Catalog metadata repository", "accessor": "MetadataRepository.GetSchemaByAPIName", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "schema, err := ms.repo.GetSchemaByAPIName(ctx, apiName)", "note": "A cache miss can return a raw, undecorated schema from a different revision. No independent Runtime request may reach this path after P7c/S1." }, { "id": "request-selected-schema", "phase": "request", "owner": "Process-global MetadataService", "accessor": "records.PersistenceService.prepareOperation", "classification": "runtime_metadata_view_required", "source_file": "nexuscrm-records/persistence_operation_gate.go", "source_anchor": "schema, err := ps.metadata.GetSchemaOrError(ctx, objectName)", "note": "The root schema is the shared input to CRUD, selection normalization, FLS, RLS, SQL mapping, and typed projection." }, { "id": "request-object-policy-schema", "phase": "request", "owner": "Process-global MetadataService", "accessor": "PermissionService.checkObjectPermissionWithState", "classification": "runtime_metadata_view_required", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "schema = ps.metadata.GetSchema(ctx, objectAPIName)", "note": "RequiredReadPermission, table type, derived AccessPolicy, sharing model, and parent capability recursion come from effective schema." }, { "id": "request-field-policy-schema", "phase": "request", "owner": "Process-global MetadataService", "accessor": "PermissionService.IsFieldReadBlocked/CheckFieldVisibilityWithUser", "classification": "runtime_metadata_view_required", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "if schema := ps.metadata.GetSchema(ctx, objectAPIName); schema != nil {", "note": "ReadProtectionPolicy and field-level derived AccessPolicy must be evaluated from the same bound schema as projection." }, { "id": "request-parent-sharing-graph", "phase": "request", "owner": "Process-global MetadataService", "accessor": "MetadataService.GetSharingParentRelationship/GetParentControlledObject", "classification": "runtime_metadata_view_required", "source_file": "nexuscrm-metadata/metadata_sharing.go", "source_anchor": "rel := ms.GetSharingParentRelationship(ctx, schema.APIName)", "note": "Parent-controlled CRUD and RLS recurse through effective relationships and parent schemas." }, { "id": "request-all-schemas-target-record-policy", "phase": "request", "owner": "Process-global MetadataService", "accessor": "PermissionService.buildTargetRecordReadFilters", "classification": "runtime_metadata_view_required", "source_file": "nexuscrm-permissions/rls_filter.go", "source_anchor": "for _, targetSchema := range ps.metadata.GetSchemas(ctx) {", "note": "A targetRecordRead row policy expands the closure to every eligible schema, not only the requested object." }, { "id": "request-sharing-rules-repository", "phase": "request", "owner": "Catalog metadata repository", "accessor": "MetadataService.GetSharingRules", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_objects.go", "source_anchor": "rules, err := ms.repo.GetSharingRules(ctx, objectAPIName)", "note": "PermissionService reaches this repository path behind a process-global five-minute TTL cache. A current repository error becomes an empty rule list. Sharing rules must come from the bound view after cutover." }, { "id": "request-sharing-rule-ttl-cache", "phase": "request", "owner": "Process-global PermissionService", "accessor": "PermissionService.getCachedSharingRules", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-permissions/sharing_rules.go", "source_anchor": "const sharingRuleCacheTTL = 5 * time.Minute", "note": "The cache can disagree with both CatalogRevision and the MetadataService pointer. It must be unreachable in the independent Runtime closure after cutover." }, { "id": "request-effective-system-permissions", "phase": "request", "owner": "Runtime permission authority", "accessor": "PermissionRepository.GetEffectiveSystemPermissions", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "perms, err := ps.repo.GetEffectiveSystemPermissions(ctx, userID, profileID)", "note": "Per-user grants remain engine authorization inputs and must be compatible with the admitted SecurityEpoch." }, { "id": "request-effective-object-permission", "phase": "request", "owner": "Runtime permission authority", "accessor": "PermissionRepository.LoadEffectiveObjectPermission", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "perm, err := ps.repo.LoadEffectiveObjectPermission(ctx, user, objectAPIName)", "note": "Object CRUD is distinguishable from missing/RLS denial and remains an engine-owned security decision." }, { "id": "request-effective-field-permission", "phase": "request", "owner": "Runtime permission authority", "accessor": "PermissionRepository.LoadEffectiveFieldPermission", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "perm, err := ps.repo.LoadEffectiveFieldPermission(ctx, user, objectAPIName, fieldAPIName)", "note": "FLS omission remains an engine-owned security decision; absent FLS rows preserve the current object-read fallback." }, { "id": "request-rls-membership-and-share-inputs", "phase": "request", "owner": "Runtime permission authority", "accessor": "PermissionRepository group/share/team methods and UserRepository role methods", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/rls_filter.go", "source_anchor": "if groupIDs, ok := ps.cachedUserGroupIDs(ctx, user.ID); ok && len(groupIDs) > 0 {", "note": "Includes group ownership, manual-share/team existence, sharing-rule membership, role descendants, and subordinate users. These facts do not enter CatalogSnapshot." }, { "id": "request-context-free-role-hierarchy-access", "phase": "request", "owner": "Runtime permission authority", "accessor": "PermissionService.GetRoleAncestors/GetRoleDescendants", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/role_hierarchy.go", "source_anchor": "func (ps *PermissionService) GetRoleDescendants(roleID string) []string", "note": "Selected-root RLS reaches context-free current-cache accessors for sharing-rule targets and owner hierarchy; they may refresh through context.Background and remain SecurityEpoch-side facts." }, { "id": "request-query-read-source", "phase": "request", "owner": "Runtime query engine", "accessor": "QueryRepository.resolveQueryReadTargetForRequestWithMemberships", "classification": "derived_from_bound_view", "source_file": "nexuscrm-persistence/query_read_target.go", "source_anchor": "baseTable, err := schema.ResolveReadSourceTable()", "note": "Physical read source, computed-field routing, selected columns, and arbitrary RLS field dependencies derive from the bound effective schema." }, { "id": "request-formula-view-routing", "phase": "request", "owner": "Runtime engine preparation", "accessor": "FormulaViewService.ResolveTableName", "classification": "derived_from_bound_view", "source_file": "nexuscrm-analytics/formula_view_service.go", "source_anchor": "func (s *FormulaViewService) ResolveTableName(ctx context.Context, schema *models.ObjectMetadata) string", "note": "Routing is determined by active computed fields in the bound schema. The process-local viewSet affects diagnostics, not the chosen fail-closed view name." }, { "id": "request-storage-hydration", "phase": "request", "owner": "Runtime projection engine", "accessor": "schemautil.FromStorageRecord", "classification": "derived_from_bound_view", "source_file": "nexuscrm-analytics/selected_root_projection.go", "source_anchor": "record := schemautil.FromStorageRecord(schema, result.Records[0], projectionFields)", "note": "Typed values and exact-decimal carriers must use the same field metadata used to build the SQL projection." }, { "id": "request-independent-receipt-source", "phase": "request", "owner": "Runtime API configuration", "accessor": "ReceiptSource.Receipts", "classification": "legacy_fallback_to_delete", "source_file": "backend/internal/runtimeapi/records_server.go", "source_anchor": "receipts, err := s.receipts.Receipts(ctx)", "note": "Receipts are read separately from metadata and engine inputs. P7c/S1 must obtain them from the same admitted serving handle." }, { "id": "admission-runtime-security-state", "phase": "admission", "owner": "Runtime security projection", "accessor": "RuntimeSecurityRepository.ReadAdmissionState", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-persistence/runtime_security_repository.go", "source_anchor": "func (r *RuntimeSecurityRepository) ReadAdmissionState(", "note": "AppInstallation, capability, SecurityEpoch, lease, and revocation remain P6 authority and must not be copied into ordinary metadata." }, { "id": "admission-replica-security-state", "phase": "startup_and_refresh", "owner": "Runtime security projection", "accessor": "RuntimeSecurityRepository.ReadReplicaSecurityContext", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-persistence/runtime_security_repository.go", "source_anchor": "func (r *RuntimeSecurityRepository) ReadReplicaSecurityContext(", "note": "The process-global replica identity/lease cache is a readiness and verification authority, not Catalog metadata." }, { "id": "admission-durable-session", "phase": "admission", "owner": "Identity session authority", "accessor": "AuthService.ValidateRuntimeSessionState", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-auth/auth_service.go", "source_anchor": "func (s *AuthService) ValidateRuntimeSessionState(", "note": "Reads session, user active/profile/role, Connected App, and AuthEpoch without ordinary HTTP caches." }, { "id": "inert-list-view-rls-wire", "phase": "composition", "owner": "Legacy MetadataService wiring", "accessor": "MetadataService.SetListViewRLSProvider", "classification": "outside_independent_runtime_closure", "source_file": "backend/internal/runtimeassembly/records_read.go", "source_anchor": "metadataService.SetListViewRLSProvider(permissionService)", "note": "No selected-root call reaches list-view metadata; this wire should not be carried into the bound read graph." }, { "id": "inert-validation-service", "phase": "composition", "owner": "Legacy records graph", "accessor": "metadata.NewValidationService", "classification": "outside_independent_runtime_closure", "source_file": "backend/internal/runtimeassembly/records_read.go", "source_anchor": "metadata.NewValidationService(formula.NewEngine())", "note": "Constructed for PersistenceService but not reached by either current read-only Records operation." } ], "process_global_state": [ { "id": "state-metadata-dual-atomic-snapshots", "phase": "process", "owner": "Process-global MetadataService", "accessor": "MetadataService.cache/coreCache", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "coreCache atomic.Pointer[metadataSnapshot]", "note": "Full and core snapshots can be published at different times; request helpers load them independently." }, { "id": "state-metadata-decorator-registry", "phase": "process", "owner": "Process-global MetadataService", "accessor": "MetadataService.schemaDecorators", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "schemaDecorators []SchemaDecorator", "note": "Three decorators are registered by composition and applied at cache-build time. P7b moves their deterministic output to the compiler." }, { "id": "state-unused-metadata-invalidation-hook-registry", "phase": "process", "owner": "Process-global MetadataService", "accessor": "MetadataService.cacheInvalidationHooks", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "cacheInvalidationHooks []func()", "note": "Refresh and invalidation notify this registry, but the selected-root composition registers no hook and no request reads it." }, { "id": "state-unused-trigger-subscription-runtime-cache", "phase": "process", "owner": "Process-global MetadataService", "accessor": "MetadataService.triggerSubscriptionRuntime", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "triggerSubscriptionRuntime triggerSubscriptionRuntimeCache", "note": "Refresh and invalidation clear this cache, but selected-root never loads or reads trigger subscriptions." }, { "id": "state-unused-global-field-index", "phase": "process", "owner": "Process-global MetadataService snapshot", "accessor": "metadataSnapshot.fieldMap", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "fieldMap map[string][]models.FieldMetadata", "note": "Built by the broad core snapshot, but selected-root resolves fields from its carried ObjectMetadata and never calls MetadataService.GetField." }, { "id": "state-unused-context-free-field-accessor", "phase": "process", "owner": "Process-global MetadataService snapshot", "accessor": "MetadataService.GetField", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)", "note": "This context-free current-metadata accessor is available on the constructed service but is not called by selected-root; field resolution uses the carried schema." }, { "id": "state-unused-key-prefix-indexes", "phase": "process", "owner": "Process-global MetadataService snapshot", "accessor": "metadataSnapshot.objectByKeyPrefixMap/keyPrefixByObjectMap", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "objectByKeyPrefixMap map[string]string", "note": "Built and duplicate-checked during core refresh, but no selected-root request resolves object identity from a record-ID prefix. C0 record-access resolves unknown object types through the Records repository rather than this metadata index." }, { "id": "state-unused-child-relationship-index", "phase": "process", "owner": "Process-global MetadataService snapshot", "accessor": "metadataSnapshot.childRelationshipsMap", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "childRelationshipsMap map[string][]*models.ObjectMetadata", "note": "Built by the broad relationship snapshot, but selected-root uses only the relationship map for sharing-parent resolution." }, { "id": "state-permission-role-hierarchy", "phase": "process", "owner": "Runtime permission authority", "accessor": "PermissionService.roleHierarchyCache", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "roleHierarchyCache map[string]*string", "note": "Security-side cache with a 60-second lazy refresh policy." }, { "id": "state-permission-sharing-rules", "phase": "process", "owner": "Process-global PermissionService", "accessor": "PermissionService.sharingRuleCache", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "sharingRuleCache map[string]*cachedSharingRules", "note": "Catalog metadata cached independently of CatalogRevision for five minutes." }, { "id": "state-permission-cache-invalidator", "phase": "process", "owner": "Runtime permission write propagation", "accessor": "PermissionService.cacheInvalidator", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "cacheInvalidator PermissionCacheInvalidator", "note": "Invalidation-only edge to the middleware system/custom cache. It owns no object/field permission result and is nil in the independent selected-root graph." }, { "id": "state-formula-view-set", "phase": "process", "owner": "Runtime engine preparation", "accessor": "FormulaViewService.viewSet", "classification": "derived_from_bound_view", "source_file": "nexuscrm-analytics/formula_view_service.go", "source_anchor": "viewSet map[string]bool", "note": "Not warmed by SelectedRootReadRuntime.Prepare. ResolveTableName still routes active-computed schemas to the fail-closed view name." }, { "id": "state-unused-formula-validation-projection-cache", "phase": "process", "owner": "Process-global FormulaViewService", "accessor": "FormulaViewService.validationProjection", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-analytics/formula_view_service.go", "source_anchor": "validationProjection *validationProjectionCache", "note": "Constructed with FormulaViewService, but selected-root table-name resolution never reads validation projection closures." }, { "id": "state-unused-formula-function-executable-registry", "phase": "process", "owner": "Process-global FormulaViewService", "accessor": "FormulaViewService.functionExecutables", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-analytics/formula_view_service.go", "source_anchor": "functionExecutables *formula.ExecutableFunctionRegistry", "note": "Refreshed during construction for formula compilation, but selected-root ResolveTableName does not consult it." }, { "id": "state-runtime-security-replica", "phase": "process", "owner": "P6 Runtime security authority", "accessor": "RuntimeSecurityState.replica/readiness", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "backend/internal/runtimeapi/security_admission.go", "source_anchor": "type RuntimeSecurityState struct {", "note": "Lease-backed Org/audience/SecurityEpoch state remains independent of Catalog metadata." } ], "refresh_and_invalidation_paths": [ { "id": "refresh-decorator-registration-invalidation", "phase": "construction", "owner": "Process-global MetadataService", "accessor": "MetadataService.RegisterSchemaDecorator", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "ms.InvalidateCache()", "note": "Each of the three registrations clears both metadata pointers before Prepare rebuilds them." }, { "id": "refresh-startup-broad-cache", "phase": "startup", "owner": "Process-global MetadataService", "accessor": "MetadataService.RefreshCache", "classification": "legacy_fallback_to_delete", "source_file": "backend/internal/runtimeassembly/records_read.go", "source_anchor": "if err := r.Metadata.RefreshCache(ctx); err != nil {", "note": "The only Records startup metadata refresh is explicit and broad; the candidate graph has no Catalog watch or periodic metadata refresh." }, { "id": "refresh-core-early-publication", "phase": "startup_or_explicit_refresh", "owner": "Process-global MetadataService", "accessor": "MetadataService.coreCache.Store", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "ms.coreCache.Store(coreSnap)", "note": "Core authorization metadata becomes current before ancillary cache loading completes." }, { "id": "refresh-full-publication", "phase": "startup_or_explicit_refresh", "owner": "Process-global MetadataService", "accessor": "MetadataService.cache.Store/coreCache.Store", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-metadata/metadata_service.go", "source_anchor": "ms.cache.Store(snap)", "note": "The full snapshot replaces both pointers only after ancillary loading." }, { "id": "refresh-role-constructor-background", "phase": "construction", "owner": "Runtime permission authority", "accessor": "PermissionService.refreshRoleHierarchy", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/service.go", "source_anchor": "ps.refreshRoleHierarchy(context.Background())", "note": "PermissionService loads roles during construction, then SelectedRootReadRuntime.Prepare loads them again." }, { "id": "refresh-role-lazy-background", "phase": "request_triggered", "owner": "Runtime permission authority", "accessor": "PermissionService.ensureRoleHierarchyFresh", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "nexuscrm-permissions/role_hierarchy.go", "source_anchor": "ps.ensureRoleHierarchyFresh(context.Background(), roleID)", "note": "Role ancestor/descendant access can refresh outside the request context after cache miss or TTL expiry." }, { "id": "refresh-sharing-rule-explicit-only", "phase": "admin_write_hook", "owner": "Process-global PermissionService", "accessor": "PermissionService.InvalidateSharingRuleCache", "classification": "legacy_fallback_to_delete", "source_file": "nexuscrm-permissions/sharing_rules.go", "source_anchor": "func (ps *PermissionService) InvalidateSharingRuleCache()", "note": "The selected-root composition registers no metadata invalidation hook for this cache; TTL is its steady-state cross-process refresh mechanism." }, { "id": "refresh-formula-function-registry-construction", "phase": "construction", "owner": "Process-global FormulaViewService", "accessor": "FormulaViewService.RefreshRuntimeFunctionRegistry", "classification": "outside_independent_runtime_closure", "source_file": "nexuscrm-analytics/formula_view_service.go", "source_anchor": "_ = svc.RefreshRuntimeFunctionRegistry()", "note": "Constructor-time refresh populates formula compilation state, but selected-root ResolveTableName never consumes it." }, { "id": "refresh-runtime-security-replica", "phase": "startup_and_explicit_refresh", "owner": "P6 Runtime security authority", "accessor": "RuntimeSecurityState.Refresh", "classification": "security_authoritative_not_ordinary_metadata", "source_file": "backend/internal/runtimeapi/security_admission.go", "source_anchor": "func (s *RuntimeSecurityState) Refresh(ctx context.Context) error", "note": "Replica lease and SecurityEpoch refresh owns readiness and remains separate from Catalog publication." } ], "runtime_metadata_view_facts": [ "catalog_revision_and_content_checksum", "complete_effective_object_and_field_schemas", "complete_effective_relationship_graph", "sharing_rules_grouped_by_object", "selected_root_schema_relationship_and_physical_read_source_indexes", "capability_and_engine_generation_compatibility_receipts" ], "p7c_consumer_switches": [ "runtimeapi.RecordsServer receipt and view binding", "records.PersistenceService root schema reads", "permissions.PermissionService object, field, parent, target-record, and sharing-rule metadata reads", "analytics.QueryService schema and RLS metadata provider", "persistence.QueryRepository and FormulaViewService derived routing from the carried bound schema" ], "p7c_unreachable_edges": [ "runtimeassembly.RecordsReadDependencies.MetadataRepo", "runtimeassembly metadata.NewMetadataService construction", "runtimeassembly MetadataService.RefreshCache startup", "runtimeassembly selected-root-irrelevant ancillary flow/validation/autonumber/identifier loads", "MetadataService current atomic cache access from independent Runtime requests", "MetadataService.GetSchema repository miss fallback from independent Runtime requests", "MetadataService.GetSharingRules repository read from independent Runtime requests", "PermissionService five-minute sharingRuleCache from independent Runtime requests", "runtimeapi.ReceiptSource independent request read", "inert list-view RLS and ValidationService wiring in the selected-root graph" ], "non_serving_guard": { "p7b_must_not_change_current_command_entrypoint": true, "p7b_must_not_add_production_snapshot_import_to_runtimeapi_or_runtimeassembly": true, "p7b_must_not_make_any_engine_consumer_selectable": true, "p7b_must_not_add_repository_fallback": true, "p7b_must_publish_only_after_full_parity": true } }