# Store Domain Follow-up Coverage Matrix

This matrix maps the independent store-domain analysis reports for Issue #491 to
PR #494 scope. It is deliberately explicit about deferred items so the single PR
does not imply that every architectural recommendation is fully solved.

## PR #494 implemented / guardrailed scope

| Recommendation | Status in PR #494 | Rationale / next step |
|---|---|---|
| Add ownership matrix for high-risk store domains (`app`, `privateagent`, `message`, `organization`). | Implemented / guardrailed. | `internal/store/README.md` records write invariants, table ownership, shared read models, and allowed callbacks. |
| Block provider-side `internal/store/app/ports`. | Guardrailed. | `guardrails/store/check-store-domain-split-guardrails.py` fails when that path exists. Future ports should be consumer-side. |
| Block generic child packages such as `helpers`, `ports`, and `repository`. | Guardrailed. | Guardrail rejects those package names under `internal/store` unless a future planning PR explicitly allowlists one. |
| Reduce app hub by removing duplicated machine/agent ownership SQL. | Implemented. | Slice B delegates to `internal/store/access` ownership lookups while preserving app error mapping. |
| Investigate repeated app domain store construction in `domain_adapters.go`. | Implemented first safe step. | Slice D caches the message collaborator in `Store.New`; broader collaborator caching is deferred until callback cycles are individually verified. |
| Add app capability map and app split/delegation direction. | Implemented / documented. | `internal/store/app/README.md` maps registry, installation, runtime/auth, webhooks/provider, messaging, authz, and collaborators. |
| Phase 1 sqlx/coredb hygiene: replace low-risk manual single-row `Scan` sites. | Implemented in Slice C. | Low-risk single-row reads moved to `coredb.Get`; tests/build cover the changed packages. |
| Phase 2 sqlx/coredb hygiene: safe `Select` + first-row migration. | Audited by #t720; no additional candidates found. | Slice C moved manual row loops to `coredb.Select`; #t720 audit found remaining `Select` calls are legitimate multi-row queries. |
| No direct `sqlx` imports in store domains. | Guardrailed by review scope. | PR keeps store domains on `coredb`; final review should grep direct `sqlx` imports. |

## Deferred recommendations

| Recommendation | Status | Why deferred from PR #494 | Next candidate direction |
|---|---|---|---|
| Full physical split of `internal/store/app` into registry / installation / runtime / webhooks packages. | Deferred. | It changes transaction ownership and many callers; doing it in this multi-agent PR would hide behavior changes. | Start with `app/registry` only after a narrow consumer-side interface and child-package guardrail allowlist are ready. |
| Move broad app cross-domain orchestration to `internal/service/<domain>`. | Deferred. | Requires API/service caller inventory beyond store-only follow-up. | Plan a service-oriented PR after app registry/runtime seams are explicit. |
| Move `internal/store/model` records back to owning domains. | Deferred. | `model` is shared by many packages and testkit; moving records is high-churn. | Add a model ownership inventory, then move one record family at a time. |
| Convert `taskboard` custom errors to `storeerr`. | Deferred. | Outside app/coredb slices; taskboard behavior needs focused API compatibility tests. | Dedicated taskboard error normalization PR. |
| Broader duplicate helper cleanup (`uniqueViolationMatches`, `execWithinSavepoint`, `normalizeNonEmptyStrings`, `preferredDisplayName`, `mapMessagingError`). | Partially deferred. | Slice B only removed the app/access ownership SQL duplicate; generic helper packages are intentionally blocked. | Move helpers only to owning capability packages (`coredb` for SQL savepoint/unique helpers, domain package for domain-specific mapping). |
| Split `privateagent` into projection / participants / history / notifications / task target. | Deferred. | README already notes privateagent should wait until Task-native ownership settles; premature split risks churn. | Revisit after task-native convergence with ownership table and tests per sub-boundary. |
| Reduce privateagent-message coupling. | Deferred. | Requires a message primitive interface or service seam; not safe as a side effect of coredb cleanup. | Define consumer-side message primitives for privateagent, then migrate one call family. |
| Clarify `message/{diagnostics,search,readstate}` child package ownership. | Deferred / guardrailed. | Current guardrail allowlist permits the packages; making diagnostics a stronger boundary needs focused message tests. | Promote diagnostics to own queries/tests or fold helper-only functions back into message. |
| Split organization directory/sync beyond `organization/feishu`. | Deferred. | Feishu transport is isolated; directory/sync state-machine ownership needs a separate org-domain plan. | Candidate `directory`/`sync` package only when it owns provider-neutral sync state. |
| Treat `access` as stable shared authz/read-model kernel. | Implemented by direction / partially in code. | Slice B moves duplicated app ownership lookups back to access. | Continue moving duplicated authz SQL to access when semantics match. |
| Keep `testkit` broad but test-only. | Guardrailed by convention. | Production packages do not import testkit; no code change needed here. | Add an explicit production-import guardrail if this regresses. |
| Provider/app coupling and possible `provider` as app sub-boundary. | Deferred. | Provider integration crosses runtime/webhook/install flows; moving it now would be a larger behavior PR. | Inventory provider callbacks, then isolate provider transport before domain ownership changes. |
| Merge tiny `agentops` into `agent`. | Deferred. | Current PR instead caches the collaborator; merging packages would change public imports and build shards. | Decide in a separate package-lifecycle cleanup after importers are measured. |
| Phase 3 sqlx/coredb hygiene: migrate positional `$N` calls to named parameters to reduce rebind work. | Deferred with #t720 analysis. | Broad SQL churn with limited behavior payoff; many queries depend on dynamic CTE positional args and coredb does not expose named read APIs. | If revisited, add `coredb.NamedGet`/`NamedQuery` first, then migrate one well-tested domain at a time. |
| Phase 4 sqlx/coredb hygiene: type `coredb.Select`/`Get` queryer arguments instead of `any`. | Deferred with #t720 analysis. | `coredb.Tx` currently does not declare `Getter`/`Selector`; changing this is a cross-package coredb API migration. | First extend `coredb.Tx`/queryer interfaces, then change `Get`/`Select` signatures and migrate packages incrementally. |