# Issue-tracker Runtime Records conformance

This is the NexusCRM test-only non-CRM composition root for tracking issue
#3555. It records the merged app-packs fixture revision and executes a reviewed
source snapshot against the real Records adapters used by Runtime. The revision
is provenance; it does not control an external CI checkout or executable source
path.

The production assembly is:

```text
serverruntime.Run
  -> services.NewServiceManager
  -> records.NewPersistenceService
  -> records.NewContractService
  -> ServiceManager.NeutralRecords / RecordsContract
```

V1a also wires that same `records.ContractService` into the dormant
`runtime-api` RecordsService graph. The production command remains explicitly
non-serving; route ownership does not move until the later atomic V1b cutover.

The tagged tests in `nexuscrm-records/issue_tracker_conformance_test.go` connect
the reviewed fixture snapshot directly to `records.ContractService`. Their
repository and permission metadata are test wiring. Point-read executes the
real `PersistenceService.Retrieve` path. Record-access executes the real
`ContractService.EvaluateRecordAccess` path, including object resolution,
object CRUD, RLS/sharing, lock and delete-policy evaluation, and disclosure
masking. The fixture never reads the database or imports a NexusCRM internal
package.

The fixture dependency is added with a temporary Go modfile only while the
tagged tests run. `app-packs-fixture/` contains the reviewed point-read files
and the contract-owned record-access vector consumer from the revision in
`app-packs-revision`; `app-packs-fixture.snapshot.sha256` seals every copied
file. CI never checks out or executes independently pinned app-packs code.

The secret-bearing production job executes only NexusCRM-reviewed source: the
snapshot conformance test and a separate negative production-closure guard.
Normal module files, production commands, images, routes, and distribution
composition do not depend on the fixture. It is not a product App or a serving
route. Updating the snapshot requires an ordinary reviewed NexusCRM diff plus
the new app-packs provenance revision and hash manifest.

Run both the real-adapter matrix and the production-closure guard with:

```bash
scripts/ci/test-issue-tracker-runtime-conformance.sh
scripts/ci/check-sealed-conformance-fixture-boundary.sh
```