# nexuscrm-contract/wire-go Generated and handwritten gRPC bindings for reviewed coarse neutral Runtime platform capabilities: - `runtime.records.read-selected-root.v1` - `runtime.records.evaluate-access.v1` - `runtime.records.mutate.v1` - `runtime.records.query.v1` - `runtime.records.related-counts.v1` - `runtime.records.preview-create-defaults.v1` - `runtime.records.list-recycle-bin.v1` - `runtime.records.mutate-recycle-bin.v1` - `runtime.records.read-record-view.v1` - `runtime.records.resolve-attachment-sources.v1` - `runtime.search.records.v1` - `runtime.permissions.read-effective.v1` - `runtime.approvals.execute.v1` - `runtime.approvals.read.v1` - `runtime.approvals.read-notification-flows.v1` - `runtime.metadata.resolve-page-layout.v1` - `runtime.identity.session-lifecycle.v1` - `runtime.commands.read-application-result.v1` - `runtime.outbound-intents.consume.v1` - `runtime.list-views.private.v1` - `runtime.metadata.read-admin.v1` - `runtime.records.bulk-ingest.v1` - `runtime.permissions.admin.v1` - `runtime.permissions.authoring.v1` - `runtime.analytics.authoring.v1` - `runtime.resources.access.v1` - `runtime.application-navigation.v1` - `runtime.layout.authoring.v1` - `runtime.catalog-serving-binding.v1` (inert Catalog receipt value; no RPC) - Proto package: `nexuscrm.runtime.v1` - Services: `RecordsService`, `RecordMutationsService`, `RecordQueryService`, `RelatedRecordCountService`, `RecordCreateDefaultPreviewService`, `RecycleBinReadService`, `RecycleBinMutationService`, `RecordViewReadService`, `RecordAttachmentSourceResolutionService`, `RecordSearchService`, `EffectivePermissionService`, `ApprovalService`, `SessionLifecycleService`, `FederatedLoginTransactionService`, `ApplicationResultService`, `OutboundIntentService`, `OutboundIntentNoEffectService`, `ConnectedMailboxAuthorizationService`, `PrivateListViewService`, `MetadataAdminReadService`, `PermissionAdministrationService`, `AnalyticsAuthoringService`, `PermissionAuthoringService`, `ResourceAccessService`, `LayoutAuthoringService`, `ApprovalNotificationFlowReadService`, `PageLayoutResolutionService`, `BulkIngestService` - RPCs: `ReadSelectedRoot`, `EvaluateRecordAccess`, bounded client-streaming `MutateRecords`, `GetMutationStatus`, `QueryRecords`, `QueryHistory`, and `CountRelatedRecords`, `PreviewCreateDefaults`, `ListRecycleBin`, `RestoreRecycleBin`, `PurgeRecycleBin`, `ReadRecordView`, and `ResolveAttachmentSources`, `SearchRecords`, `ReadSearchScopeOrder`, and `ReadEffectivePermissions`, `ExecuteApproval`, `ReadApproval`, `CreateSession`, `ReadSession`, `RevokeSession`, `BeginFederatedLogin`, `ConsumeFederatedLogin`, `GetApplicationResult`, `ListPendingOutboundIntents`, `AcknowledgeOutboundIntent`, and `CommitOutboundResult`, `CommitOutboundNoEffect`, `AuthorizeConnectedMailbox`, `ReauthorizeConnectedMailbox`, `ReadPrivateListViews`, and `MutatePrivateListView`, `ReadObjectAdminIndex`, `ReadLayoutAdminWorkspace`, `ReadStoredLayout`, and `ReadValidationRuleAdminIndex`, `CreateBulkIngestJob`, `ReadBulkIngestJob`, `CloseBulkIngestJob`, bounded client-streaming `UploadBulkIngestData`, and `ReadApprovalNotificationFlows`, `ResolvePageLayout`, `ReadPermissionAdministration`, `MutatePermissionAdministration`, `ReadPermissionAuthoringSnapshot`, `SavePermissionAuthoring`, `GetPermissionAuthoringStatus`, `MutateAnalyticsDefinition`, `AccessResource`, `Submit`, `GetCommand`, `ReadWorkspace`, and `ReadStoredLayout` `PermissionAuthoringService` owns one coherent stored PermissionSet aggregate across system, object, field, RecordType, and custom grants. Snapshot and Save resolve a Profile to its canonical PermissionSet, while a direct PermissionSet target must correlate exactly with the returned canonical identity. Save is one durable atomic command; Status reconciles its terminal result after an ambiguous transport outcome without repeating the mutation. `LayoutAuthoringService` is a bounded unary, typed lifecycle. It carries one Layout operation per command, four public command states, and exact authoring view references containing both Catalog revision and artifact digest. Internal recovery phases are not wire values. Stored documents preserve authored presence, including absent, nil, and present-empty field-behavior maps. The stdlib-only semantic owner bounds a document to 2 MiB and a complete request or response to 3 MiB; the shared uncompressed transport envelope remains 4 MiB. `ListPendingOutboundIntentsRequest.max_operation_set_version` is an explicit response compatibility ceiling. Zero and one admit only the legacy UPSERT/DELETE operation set. A consumer must advertise version two before Runtime can emit SEND_MAIL, so binaries released before the field existed never receive an enum value they cannot decode. `logical_effect_root_id` and `logical_effect_generation_id` are an optional pair. Existing producers may omit both and retain their identifier and idempotency-key authority. An explicitly opted-in producer supplies both and derives the two durable keys from trusted org, application-installation, and authorized-workload scope plus the effect root, `action_slot_id`, and occurrence generation. Partial coordinates and noncanonical keys remain invalid. `FederatedLoginTransactionService` is carried by the existing `runtime.identity.session-lifecycle.v1` capability. Its two RPCs add the pre-session opaque-state transaction without requiring a separate application installation capability migration. Request decode failures use the dedicated federated-login request-status mapper. After request validation, Begin and Consume owner results use separate operation-status mappers; Consume collapses unknown, expired, replayed, redirect-mismatched, and equivalent state outcomes to one detail-free `UNAUTHENTICATED` status before selecting a gRPC code. `PrivateListViewService` is app-blind and bound to the authenticated delegated principal. Its read selector lists or describes only that principal's private views; its single mutation operation creates, updates, or deletes them. Owner, visibility, tenant, application-installation, permission, and public route facts are intentionally absent. An absent view, an object mismatch, and a view owned by another principal are all `MISSING` so the capability is not an ownership oracle. `OutboundIntentService` exposes only Runtime-owned immutable provider-neutral intents, Integration's durable acceptance receipt, and idempotent Runtime local projection after Integration has already persisted provider success. Provider credentials, endpoint selection, dispatch, retry, uncertain-outcome repair, and remote-link reconciliation remain Integration-owned and absent from this wire. `OutboundIntentNoEffectService` is a separate additive service for the Catalog-retirement terminal hand-back; keeping it separate preserves the published `OutboundIntentServiceClient` and `OutboundIntentServiceServer` method sets. `ApplicationResultService.GetApplicationResult` is separate from `CommandAcceptanceService.AcceptCommand`: durable inbox acceptance is not application completion. The read carries only the exact command ID and ExecutionRef digest. A pending response exposes no Runtime scheduler state; a terminal response carries only the Runtime-owned result digests, closed outcome, disclosure-safe failure code, and deterministic commit receipt. The full ExecutionRef, result payload, internal error text, and a second completion authority remain outside the wire. `RecordViewReadService` owns only `ReadRecordView` on new Runtime servers. Its historical `ResolveRecordAttachmentSources` descriptor remains for N compatibility, but cannot prove FLS-visible source-field provenance and must not be implemented by a new server. The separate `RecordAttachmentSourceResolutionService.ResolveAttachmentSources` carries at most 16 field-bound parsed source values. Every value includes its exact byte offset in the current raw field, which Runtime verifies after CRUD/RLS/FLS and before its Catalog-bound source lookup. Source grammar, URL syntax, relation names, joins, authorization policy, relationship envelopes, and product errors are not wire facts. The capability reuses the approved 64 KiB semantic request, 1 MiB complete response, and shared 4 MiB private unary transport envelope; its exact boundary evidence leaves 4,129,751 request bytes and 3,146,381 response bytes of transport headroom with compression disabled. - Go module: `github.com/pingcap-inc/nexuscrm-contract/wire-go` - Server receive / send caps: 4 MiB / 4 MiB - Client send / receive caps: 4 MiB / 4 MiB - Compression: disabled and rejected for v1 Mutation retains its independent 120 KiB maximum chunk payload even though the shared transport envelope is 4 MiB. The complete command is bounded to 25 MiB of compact canonical semantic bytes, preserving the current public buffered mutation-body ceiling without turning that command into one unary message. The header digest protects encoded frame reassembly only; idempotency is computed from the stdlib-only, cross-language canonical semantic grammar after decode. A lost response is reconciled by command identity and is never treated as proof of rollback. For selected-root, the largest structurally valid request is 34,720 semantic bytes and 34,127 protobuf bytes. The 64 KiB exact/one-over request fixtures are adversarial outer-cap codec vectors, not executable business shapes: the independent 64-byte field-name limit rejects them first. The exact 1 MiB complete response fixture is structurally valid and encodes to 1,032,006 protobuf bytes. For record-access, the current public route's 200 submitted-record bound plus the existing 64-byte object and 255-byte record identifier bounds produce a largest business request of 51,666 protobuf bytes and a largest complete response of 53,490 protobuf bytes. Those facts leave 4,142,638 bytes of request headroom and 4,140,814 bytes of response headroom under the shared transport caps. The generic HTTP route's 25 MiB buffered-body ceiling is not a business contract. No second semantic byte limit is invented because count and identifier limits already bound every record-access message. `envelope` publishes only the approved message caps and protocol/capability metadata keys. It also publishes the inert `x-nexuscrm-runtime-delegation` ASCII compact-JWS carrier name; the semantic codec lives in the stdlib-only root package. Production gRPC server options, interception, delegation admission, compression observation, and client connection policy belong to `nexuscrm-api-host` and P3; this repository exercises the required behavior with test-only bufconn wiring. Every RPC attempt requires a native context deadline. Missing deadlines are `INVALID_REQUEST`; an already expired deadline is `DEADLINE_EXCEEDED`. Selected-root retains its approved earlier-of clamp and two-second attempt cap published as `recordsv1.MaxAttemptDuration`. V1a-C does not transfer that capability-specific number to record-access: its production attempt cap remains an adapter/cutover evidence decision. Deadline, cancellation, request ID, and trace context are not semantic protobuf fields. All Runtime v1 operations require fail-fast overload admission; excess work is `RESOURCE_EXHAUSTED`, never an unbounded in-process queue. The concrete per-replica concurrency value remains deployment configuration, not wire grammar. Record-query requests carry only an already-parsed, closed neutral plan. Query text, public cursor grammar, CRM response envelopes, and product errors remain L1-owned. Predicate and operand depth/node ceilings are enforced during inbound wire decoding as well as semantic validation, so an attacker-controlled tree cannot recurse past the advertised contract before the limits take effect. The query family's complete semantic response budget is 4 MiB (formerly 1 MiB) for both record pages and field history. The ordinary 2,000-row bound and the shared 4 MiB uncompressed gRPC send/receive caps are unchanged. Semantic bytes count the JSON carrier including receipts, plus any decimal expansion; gRPC counts protobuf message bytes, not the HTTP JSON response or the five-byte gRPC frame header. The exact-boundary transport tests cover both query branches: the record fixture encodes 4,194,304 semantic bytes into 4,194,004 protobuf bytes; the history fixture encodes into 4,194,056 bytes. A one-byte semantic overflow is rejected before sending the response, with a typed `SEMANTIC_RESPONSE_BYTES` failure carrying the actual approved maximum. Grouped queries may request and return one internal overflow sentinel beyond that row bound (2,001 aggregate rows). Both request and response validation preserve this row for the caller's overflow decision. Ordinary requests, ordinary response pages and history retain the 2,000-row bound; public grouping and pagination behavior does not change. Row-limit errors preserve either approved maximum (2,000 ordinary rows or 2,001 aggregate probe rows). Release both the semantic root and wire module, then update all query readers (including the L1 AppService's Runtime client) before enabling the larger response budget on Runtime producers. The previous reader still enforces 1 MiB and cannot accept a larger response. New readers accept the previous peer's typed 1 MiB rejection as well as the current 4 MiB rejection, preserving clear errors during rollout; new writers emit only the current limit. These are the two explicitly supported error maxima, not an arbitrary peer budget. Related-count requests carry at most 50 normalized count specifications in one coarse RPC. Each specification preserves a separate parent-record authorization fact even when metadata selects an alternate child-predicate match value. Successful item results are position-correlated and expose only `COUNTED` (including exact zero) or opaque `NOT_AVAILABLE`; they do not create an object, field, or parent-record existence oracle. Product route grammar and response projection remain L1-owned. Recycle-bin list requests select only caller-owned or all-authorized scope; identity and permission authority remain TrustedCall transport facts. Runtime returns at most 200 caller-visible deleted records after CRUD/RLS/FLS checks and may report bounded, sanitized per-object failures without failing successful objects. The existing 2,000-candidate scan is an engine bound, while the 1 MiB complete semantic response cap is a new v1 defensive envelope. Its largest legal response encodes to 1,048,301 protobuf bytes, leaving 3,146,003 bytes under the shared 4 MiB send cap. Product aliases, total/partial flags, URL scope spelling, restore, and purge remain outside this read contract. Successful `ReadSelectedRootResponse.fields` entries are sorted by canonical field API name in ascending bytewise UTF-8 order. Clients must not interpret request order, metadata declaration order, map order, or storage-column order as response order. Successful `EvaluateRecordAccessResponse.results` entries are unique and sorted by record identifier in ascending bytewise UTF-8 order. Missing and Read-denied records are absent. A non-forbidden operational failure fails the whole RPC; there is no partial response. The optional-object branch performs mixed-type resolution inside the same Runtime call. The stdlib-only semantic owners are `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordsv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordaccessv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordmutationv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/queryv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/relatedcountsv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recorddefaultsv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recyclebinv1`, and `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordviewv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordattachmentsv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/searchv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/flowv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/reportv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/filesv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/bulkingestv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/commandv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/applicationresultv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/outboundintentv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/mailboxauthorizationv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/effectivepermissionsv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/listviewv1`, `github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/layoutauthoringv1`, and `github.com/pingcap-inc/nexuscrm-contract/pkg/catalog/consumerv1`, plus their shared `pkg/runtime/commonv1` facts. This nested module owns generated protobuf/gRPC dependencies and semantic-to-wire mapping. It does not contain a Runtime command, server assembly, production route, authority implementation, or database access. The nested module pins the reviewed root semantic release declared by its `go.mod`, the sole live version owner. The committed module graph contains neither an unpublished version nor a local `replace`; repository CI separately compiles the wire module against the exact checked-out root through an ephemeral workspace. Application navigation uses `ApplicationNavigationService.Read`, `.Resolve`, and `.Save` for synchronous current configuration. Item presence distinguishes a missing save value from an explicit empty navigation. Resolve uses protobuf repeated fields: omitted IDs/documents normalize to empty semantic lists.