# App Store Capability Map

`internal/store/app` keeps the user-facing App facade while its durable state is
owned by the Service Actor, Service Event, and canonical provider substrates.

## Current ownership rules

- Built-in provider registry, installation approval, provider credential,
  webhook, message, and authorization workflows stay here only when they need
  cross-domain transaction boundaries or the public App facade.
- New durable service state lives in the Service Actor substrate and is surfaced
  here through narrow orchestration methods.
- Pull request subscription delivery is modeled as Service Event subscription,
  receipt, and delivery ledgers. Provider-watch compatibility remains explicit in
  its dedicated adapter; App runtime paths do not read or write legacy App tables.
- Message writes should pass through the message/privateagent write contracts;
  this package should not grow independent message persistence behavior.
- Access checks should use the access/service collaborators instead of adding
  generic ports, repositories, or helper layers.

## Split conditions

Further physical child packages should only be introduced when all of the
following are true:

1. the package owns a named capability or invariant, not a generic layer;
2. callers can use a narrow consumer-side interface without importing the whole
   store;
3. transactions and workspace/member side effects have a clear owner; and
4. the store-domain guardrail explicitly allows the new boundary.