# Runtime records v1 compatibility baselines

`selected-root-v1.binpb` is the immutable initial Buf image for
`nexuscrm.runtime.v1.RecordsService`. CI compares the live proto source against
it with `buf breaking`.

`record-access-v1.binpb` is the immutable additive image that first includes
`EvaluateRecordAccess`. CI checks both images: the original proves selected-root
was not broken, while the newer image protects the complete two-RPC service and
record-access message grammar.

`record-mutation-v1.binpb` is the immutable image that first includes the
separate neutral `RecordMutationsService`, its bounded client-streaming command,
terminal result, and reconciliation grammar. It also fixes the additive safe
error components used by this capability.

`identity-exchange-v1.binpb` is the immutable additive image that first
includes the neutral `IdentityContext.Exchange` service. The raw end-user
credential remains transport metadata and therefore has no protobuf field.

`session-lifecycle-v1.binpb` is the immutable additive image that first
includes the neutral `SessionLifecycleService` on the same private Runtime
endpoint. Login credentials, access and replacement tokens, and browser
control proofs remain transport metadata; the protobuf carries only bounded
policy selectors and the current neutral principal projection.

`federated-login-v1.binpb` is the immutable additive image that first includes
the neutral `FederatedLoginTransactionService`. It protects the begin/consume
shape for one redirect-bound, expiring, single-use opaque state while keeping
provider identifiers, public OAuth routes, credentials, and token exchange
outside the private Runtime wire contract.

`authorization-lifecycle-v1.binpb` is the immutable additive image that first
includes the app-blind authorization-code lifecycle on the existing private
Runtime endpoint. OAuth HTTP redirects and response envelopes remain L1-owned;
client secrets, codes, verifiers, access tokens, and refresh tokens remain
transport metadata rather than protobuf fields.

`record-query-v1.binpb` is the immutable additive image that first includes the
neutral bounded `RecordQueryService` records-page and history operations.
External query and cursor grammars, route envelopes, and product errors remain
outside this baseline.

`related-counts-v1.binpb` is the immutable additive image that first includes
the neutral bounded `RelatedRecordCountService`. Its one coarse RPC preserves
parent authorization independently from the child match value and exposes only
position-correlated counted or opaque-unavailable item outcomes.

`record-default-preview-v1.binpb` is the immutable additive image that first
includes the neutral bounded `RecordCreateDefaultPreviewService`. It protects
typed default values, closed provenance, optional parent context, and one
consistency receipt set while keeping identity, authorization, product layout,
and public response grammar outside the protobuf.

`recycle-bin-v1.binpb` is the immutable additive image that first includes the
neutral bounded `RecycleBinReadService`. Its one coarse RPC carries no caller-
selected authority, exposes each record identity once, keeps private tombstone
keys out of the wire, and retains sanitized partial per-object outcomes.

`recycle-bin-mutation-v1.binpb` is the immutable additive image that first
includes the neutral `RecycleBinMutationService`. It protects the distinct
restore and permanent-purge RPC methods, their bounded record identity and
Catalog revision fence, and consistency receipts. The operation is owned only
by the RPC method; caller authority and product route grammar remain transport-
and L1-owned.

`record-attachment-sources-v1.binpb` is the immutable additive image that first
includes the proof-bound neutral `RecordAttachmentSourceResolutionService`.
Each parsed source carries a source-field identifier and byte offset, while
identity, authorization, source grammar, and resolver plans remain outside the
wire. Its opaque unavailable result cannot disclose which protected check
failed.

`platform-api-v1.binpb` is the immutable additive image that first includes the
phase-one private Platform API service families: authorized Catalog consumer
views, record search, Flow execution, report reads, bounded authorized files,
and command acceptance. Catalog views and Runtime capabilities retain separate
package/proto owners while their coarse services are registered on one private
L0 endpoint; the image contains no public dialect or product API.

`effective-permissions-v1.binpb` is the immutable additive image that first
includes `EffectivePermissionService.ReadEffectivePermissions` and its complete
app-blind permission projection. It preserves the earlier Platform API image
unchanged while protecting the additive service, request fence, projection,
and consistency receipts from incompatible removal or renaming.

`search-scope-order-v1.binpb` is the immutable additive image that extends the
existing `RecordSearchService` with one bounded viewer-specific scope-order
read. The caller supplies only Catalog-projected candidate object identities;
Runtime returns only the authorized subset and receipts. Product labels, URLs,
key prefixes, and public wire semantics remain outside this image.

`approval-v1.binpb` is the immutable additive image that first includes the
neutral `ApprovalService.ExecuteApproval` and `ApprovalService.ReadApproval`
operations on the existing private Platform endpoint. It protects the bounded
lifecycle request, result, action-failure, and immutable revision-receipt
grammar without publishing product-specific approval wire semantics.

`catalog-action-preview-v1.binpb` is the immutable additive image that extends
the existing neutral `FlowExecutionService` with one no-effect Catalog-bound
preview operation. It protects both closed preview profiles, their immutable
action binding, request revision fence, canonical neutral result, and
consistency receipts without publishing L1 wire semantics.

`application-result-v1.binpb` is the immutable additive image that first
includes the separate neutral `ApplicationResultService`. It preserves command
acceptance unchanged while protecting exact command/ExecutionRef-digest
correlation, the pending/terminal split, closed terminal outcomes, disclosure-
safe failure codes, result digests, and the deterministic Runtime commit
receipt.

`outbound-intent-v1.binpb` is the immutable additive image that first includes
the neutral `OutboundIntentService`. It protects Runtime's immutable intent
listing, Integration's durable admission acknowledgement, and the idempotent
local-result commit grammar. Provider dispatch, credentials, retries, remote
responses, and reconciliation remain outside this Runtime wire surface.

`private-list-view-v1.binpb` is the immutable additive image that first includes
the app-blind `PrivateListViewService`. It protects the single read selector,
single create/update/delete mutation operation, private caller-owned projection,
PATCH presence, and full consistency receipts. N clients fail closed with
`UNIMPLEMENTED` on N-1 endpoints; N servers preserve every earlier service.
Owner, visibility, tenant, application installation, and product route facts
remain outside the wire.

`metadata-admin-read-v1.binpb` is the immutable additive image that first
includes the app-blind `MetadataAdminReadService`. It protects the bounded
object administration index, stored-layout workspace, assignment dimensions,
and opaque stored authoring document carried by the original three coarse read
RPCs. That checked-in image remains the released N-1 baseline; the current N
schema adds the bounded per-object validation-rule index as the fourth RPC.
N clients fail closed with `UNIMPLEMENTED` on N-1 endpoints; N servers preserve
every earlier service. Product routes, presentation layouts, mutation commands,
and application-owned document interpretation remain outside the wire.

`bulk-ingest-v1.binpb` is the immutable additive image that first includes the
app-blind `BulkIngestService`. It protects the create/read/close lifecycle,
bounded client-streaming upload, closed ingest operation/state/failure enums,
durable job projection, and consistency receipts. Public dialect routes,
CSV interpretation, object storage authority, and worker execution remain
outside this private Runtime wire baseline.

`approval-notification-flow-v1.binpb` is the immutable additive image that
first includes the app-blind `ApprovalNotificationFlowReadService`. It protects
one bounded descriptor-only Catalog read and its consistency receipts. N
clients fail closed with `UNIMPLEMENTED` on N-1 endpoints; N servers preserve
every earlier service. Flow definitions and execution authority, protected-Flow
selection inputs, product routes, permissions, and response DTOs remain outside
the wire.

`page-layout-resolution-v1.binpb` is the immutable additive image that first
includes the app-blind `PageLayoutResolutionService`. It protects one bounded
caller-effective selection request, the complete neutral PageLayout document,
resolved related-list targets, and consistency receipts. N clients fail closed
with `UNIMPLEMENTED` on N-1 endpoints; N servers preserve every earlier service.
Profile, Role, assignment selection, product routes, and response DTO assembly
remain outside the wire.

`permission-admin-v1.binpb` is the immutable additive image that first includes
the app-blind `PermissionAdministrationService`. It protects the six bounded
catalog/grant read selectors and three bounded grant-family mutations while
keeping caller identity, administration authority, public product routes, and
product response envelopes outside the Runtime wire. Effective
permission evaluation remains an independent capability and source of truth.

`analytics-authoring-v1.binpb` is the immutable additive image that first
includes the app-blind `AnalyticsAuthoringService`. It protects one bounded
definition-mutation RPC for dashboard create/update, including root-only
patches, and analytics-folder lifecycle operations. Metadata-cascaded dashboard
deletion stays on the generic record-mutation capability; product routes and
document interpretation remain outside this wire.

`analytics-authoring-report-v1.binpb` is the later immutable additive image
that first includes saved-report create/update/delete operations and their
typed definition fields. It freezes the optional collection wrappers and the
date-filter set/clear action so a future schema cannot silently remove report
CRUD or collapse PATCH clear into absence. The semantic contract independently
requires a concrete create-folder authorization target and validates the
operation-specific definition shape.

`resource-access-v1.binpb` is the immutable additive image that first includes
the app-blind `ResourceAccessService`. It protects bounded grant creation,
replacement, deletion, and ownership-transfer administration with durable
mutation identity and consistency receipts. Authorized collection and point
reads remain on Runtime Query and record authorization, so this administrative
surface cannot become a second visibility read path. Resource-specific route
DTOs and presentation labels remain outside the wire; the platform permission
engine remains the single ACL authority.

`layout-authoring-v1.binpb` is the immutable additive image that first includes
the dedicated unary `LayoutAuthoringService`. It protects all eight typed
Layout lifecycle operations and results, the four public command states, exact
revision-plus-digest authoring view references, and the complete typed stored
document/read projections. A failed command carries exactly one of the closed
INVALID_REQUEST, FORBIDDEN, MISSING, or CONFLICT business categories; transient
runtime failures and retry advice are not terminal wire results. Internal
recovery phases, transport-host policy, Core persistence, Catalog publication,
product routes, and the universal metadata mutation dispatcher remain outside
this wire.

The generated client/server integration tests and unknown-optional-field codec
tests form each capability's initial N compatibility row. A future compatible
minor release must retain every applicable image, add the released generated
module to an actual N/N-1 matrix, and must not relabel a baseline as a version
that never shipped.

`application-navigation-v1.binpb` freezes the synchronous Read/Resolve/Save
service, typed targets, item presence wrappers, revisions, and
idempotency key. Page routes remain application-owned and are not carried in the
wire. This baseline becomes immutable when this wire version is published;
subsequent releases must retain it in the compatibility gate.