{
  "schema": "nexuscrm.runtime-metadata-snapshot.p7b/v1",
  "evidence_revision": "ecb7a11b4d854ca32f284e561bec9866df317887",
  "p7a_inventory": "docs/refactor/serviceification/runtime-metadata-closure-p7a.json",
  "a1b_contract": {
    "path": "docs/design/app-authority-contract.json",
    "anchor": "\"phase\": \"P7b\"",
    "consumed_facts": [
      "opaque Catalog-authored AppInstallationID scope",
      "capability-bound effective projection",
      "CatalogRevision and compatibility lineage",
      "no App lifecycle writer or PackManifest fallback"
    ]
  },
  "scope": {
    "current_runtime_api_entrypoint": "backend/internal/runtimeapi.AssembleNonServingBootstrap",
    "production_candidate_entrypoint": "backend/internal/runtimeapi.AssembleProduction",
    "current_runtime_worker_role": "no-work skeleton",
    "legacy_monolith_included": false,
    "serving_cutover_included": false
  },
  "consumer_map": [
    {
      "id": "runtime-api-command",
      "role": "runtime-api",
      "source_file": "backend/cmd/runtime-api/main.go",
      "source_anchor": "runtimeapi.AssembleNonServingBootstrap",
      "current_source": "no metadata source selected",
      "fallback": "none",
      "revision_assumption": "none; process is not ready or serving",
      "p7c_switch": false
    },
    {
      "id": "runtime-api-candidate-assembly",
      "role": "runtime-api candidate graph",
      "source_file": "backend/internal/runtimeapi/process.go",
      "source_anchor": "func AssembleProduction(ctx context.Context, config ProcessConfig)",
      "current_source": "runtimeassembly.NewRecordsReadRuntime",
      "fallback": "construction opens the Runtime database and prepares the legacy graph",
      "revision_assumption": "no authoritative CatalogRevision is bound to the graph",
      "p7c_switch": true
    },
    {
      "id": "runtime-receipts",
      "role": "runtime-api handler",
      "source_file": "backend/internal/runtimeapi/records_server.go",
      "source_anchor": "receipts, err := s.receipts.Receipts(ctx)",
      "current_source": "independent ReceiptSource call before engine entry",
      "fallback": "BootstrapReceipts is zero-generation and non-serving",
      "revision_assumption": "receipt values are not coupled to metadata pointers",
      "p7c_switch": true
    },
    {
      "id": "records-root-schema",
      "role": "Records selected-root",
      "source_file": "nexuscrm-records/persistence_operation_gate.go",
      "source_anchor": "schema, err := ps.metadata.GetSchemaOrError(ctx, objectName)",
      "current_source": "process-global MetadataService",
      "fallback": "MetadataService.GetSchema repository cache-miss read",
      "revision_assumption": "the returned pointer may come from current cache or a raw fallback",
      "p7c_switch": true
    },
    {
      "id": "permissions-read-metadata",
      "role": "CRUD, FLS and RLS policy evaluation",
      "source_file": "nexuscrm-permissions/service.go",
      "source_anchor": "type metadataProvider interface {",
      "current_source": "MetadataService schema/relationship methods",
      "fallback": "permission repositories plus five-minute sharing-rule cache",
      "revision_assumption": "multiple helper calls can observe different global pointers",
      "p7c_switch": true
    },
    {
      "id": "analytics-projected-query",
      "role": "query-level RLS and projection",
      "source_file": "nexuscrm-analytics/selected_root_projection.go",
      "source_anchor": "func (qs *QueryService) ReadSelectedRootProjection(",
      "current_source": "carried root schema plus PermissionService metadata calls",
      "fallback": "no snapshot fallback; permission metadata remains global/repository-backed",
      "revision_assumption": "root schema is locally stable but the recursive policy graph is not revision-bound",
      "p7c_switch": true
    },
    {
      "id": "persistence-read-shape",
      "role": "SQL projection and hydration",
      "source_file": "nexuscrm-persistence/query_repository.go",
      "source_anchor": "readTable, err := schema.ResolveReadSourceTable()",
      "current_source": "the carried ObjectMetadata and FieldMetadata",
      "fallback": "formula-view routing derives request-dependent targets from the same carried schema and otherwise fails closed",
      "revision_assumption": "physical fields and base read source inherit the root pointer's unstated generation",
      "p7c_switch": true
    },
    {
      "id": "runtime-worker-command",
      "role": "runtime-worker",
      "source_file": "backend/cmd/runtime-worker/main.go",
      "source_anchor": "runtime-worker no-work skeleton started",
      "current_source": "none",
      "fallback": "none",
      "revision_assumption": "no work capability and no metadata consumer",
      "p7c_switch": false
    }
  ],
  "p7c_atomic_switches": [
    "Runtime handler receipts and request-bound view",
    "Records root schema lookup",
    "Permissions object field parent target-record and sharing-rule metadata",
    "Analytics RLS metadata and all-schema iteration",
    "Persistence and formula routing derived from the carried bound schema"
  ],
  "artifact_model": {
    "package": "github.com/nexuscrm/metadata/catalogsnapshot",
    "catalog_schema": "nexuscrm.catalog-snapshot/v1",
    "runtime_view_schema": "nexuscrm.runtime-metadata-view/v1",
    "digest": "sha256 over canonical artifact bytes",
    "canonical_serialization": "deterministic closed JSON v1; compiler input collections and known unordered reference sets are canonicalized and unknown fields are rejected",
    "store": "exact kind plus digest reads and idempotent immutable writes only; new directory entries and every successful publication path are fsync-bounded",
    "runtime_view_source_verification": "regenerate the exact scoped projection from the named CatalogSnapshot and require the artifact digest to match",
    "freshness_authority": "none; there is no current latest watch TTL or activation operation",
    "compatibility": "exact v1 decode; unknown schemas are rejected; local physical SchemaGeneration must meet the snapshot floor; EngineGeneration must match exactly"
  },
  "axes": [
    {
      "name": "CatalogRevision",
      "meaning": "one immutable effective org Catalog publication",
      "location": "snapshot and Runtime view lineage"
    },
    {
      "name": "SchemaGeneration",
      "meaning": "physical schema compatibility floor",
      "location": "snapshot and Runtime view lineage"
    },
    {
      "name": "EngineGeneration",
      "meaning": "Runtime implementation compatibility",
      "location": "snapshot and Runtime view lineage"
    },
    {
      "name": "DefinitionVersion",
      "meaning": "identity of one executable definition, never a Catalog or engine revision",
      "location": "optional definition descriptor; absent from the selected-root projection"
    }
  ],
  "runtime_projection": {
    "scope": "OrgID plus opaque AppInstallationID plus capability",
    "included": [
      "effective object and field read shape",
      "read-relevant access and row policy",
      "complete same-revision object schema set when any included row policy is targetRecordRead",
      "minimal parent relationship edges and type without row identity presentation or mutation facts",
      "sharing-rule policy expressions and required role/group references without rule identity or display name",
      "physical field and request-dependent read-source derivation"
    ],
    "structurally_excluded": [
      "unrelated AppInstallation scopes",
      "mutation hooks validators and defaults",
      "navigation and frontend metadata",
      "Integration payloads",
      "secret values",
      "record or user data",
      "role/group entities memberships effective grants sessions and generated shares"
    ]
  },
  "selected_root_behavior_oracles": [
    {
      "path": "nexuscrm-records/issue_tracker_conformance_test.go",
      "anchor": "func TestIssueTrackerConformance_RealRuntimeRecordsAdapter",
      "proves": "current Records adapter CRUD, RLS, FLS, missing/denied masking, forbidden and cancellation semantics"
    },
    {
      "path": "backend/internal/runtimeapi/real_repository_integration_test.go",
      "anchor": "func TestRuntimeAPIRealQueryRepositoryCrossProcess",
      "proves": "current independent Runtime adapter and real repository selected-root behavior"
    }
  ],
  "known_legacy_deltas": [
    {
      "case": "duplicate case-folded object or field identity",
      "legacy": "map construction can keep one value",
      "p7b": "publication fails with a stable duplicate conflict"
    },
    {
      "case": "missing or ambiguous sharing parent",
      "legacy": "permission evaluation can degrade to no parent result",
      "p7b": "publication fails with an invalid or ambiguous relationship conflict"
    },
    {
      "case": "metadata or decorator dependency failure",
      "legacy": "some reads can degrade to empty or undecorated results",
      "p7b": "the owner must not call the compiler until complete effective input exists"
    },
    {
      "case": "non-empty sharing-rule criteria",
      "legacy": "criteria can fail later during request evaluation",
      "p7b": "publication always runs the kernel-owned Runtime-equivalent criteria normalizer and formula validator"
    }
  ],
  "non_serving_guard": {
    "runtime_commands_exclude_package_and_future_subpackages": true,
    "runtime_api_command_remains_non_serving": true,
    "production_manifests_have_no_snapshot_selector": true,
    "package_has_no_serving_selector_or_environment_activation": true,
    "tests_may_instantiate_directly": true
  },
  "p7c_follow_up": "After A1c and release publication prerequisites, install ServingAdmission after TrustedCall, bind one exact view and receipt tuple, perform all five listed atomic switch actions, and make every inventoried global/repository fallback unreachable."
}