@starci/skills 1.1.0 → 1.2.0

package/operators/architecture-decide/operator.vi.md

@@ -29,6 +29,18 @@ tiếp, quyền sở hữu datastore, sao lưu và khôi phục; phán quyết b
 không sở hữu; một store gọi tên đúng một boundary chủ và boundary đó ghi nó, người ghi thứ hai chỉ
 tồn tại khi có lý do chia sẻ ghi rõ ràng.
 
+## Quyết định gọi tên mọi lần ghi nó cam kết
+
+Một boundary sở hữu store không nói gì về việc ai ghi nó, lúc nào, dưới transaction nào, nên quyết
+định tự lấp khoảng trống đó: `response/data/stack-model.json` mang một mục `operations` cho mỗi lần
+ghi mà kiến trúc này cam kết, và bảng `## Operations` của biên nhận thuật lại đúng những hàng ấy. Mỗi
+mục gọi tên transport, writer, các store nó chạm, ranh giới transaction, kiểu idempotency, các
+migration nó mang, và các `dimension` của ma trận phủ thuộc head nghiệp vụ mà nó hiện thực. Danh sách
+đó chính là hợp đồng đóng băng mà `backend.source.apply` lấp: phần hiện thực thuật lại nguyên vẹn
+những operation đó và không được thêm cái nào, nên một operation không ai khai ở đây thì không thể
+được viết ở đâu cả. Khai một lần ghi không phải là chọn một cách hiện thực, và đó là lý do writer là
+đường dẫn file duy nhất operator này gọi tên.
+
 ## Phản biện là một cuộc trao đổi lồng
 
 Sau khi phương án đã chọn được đào sâu, nhánh tạm ngưng: nó phát `response/response.json` với status
@@ -47,12 +59,16 @@ source được route, không publish thẩm quyền nghiệp vụ, không khở
 runtime, không nêu tên file implementation trong handoff, và không tuyên bố implementation, cổng
 chất lượng hay UAT đã qua.
 
+Khi đầu vào `model` có mặt, nó là thẩm quyền của lần chạy này và head đã publish chỉ còn là dòng dõi,
+bởi một quyết định lấy theo lời hứa của hôm qua là quyết định lấy theo lời hứa sai. Khi nó vắng, head
+đã publish là thẩm quyền.
+
 ## Context
 
 | Alias | Bind | Bắt buộc |
 | --- | --- | --- |
 | `@workspaces/be` | checkout backend được route, đọc ở head đóng băng; inventory lấy từ manifest và file deploy | có |
-| `@worktrees/businesses/<featureId>` | head nghiệp vụ đã publish, lời hứa mà kiến trúc phải giữ | có |
+| `@worktrees/businesses/<featureId>` | head nghiệp vụ đã publish, lời hứa mà kiến trúc phải giữ; chỉ là bằng chứng khi phiên mang đầu vào `model` | có |
 | `@knowledge/patterns` | hình dạng tái dùng mà scope có thể ràng; là hình dạng, không bao giờ là lựa chọn | không |
 
 ## Đầu vào
@@ -60,6 +76,7 @@ chất lượng hay UAT đã qua.
 | Kind | Từ đâu | Bắt buộc |
 | --- | --- | --- |
 | `architecture-decision` | một lần chạy `architecture.decide` trước trên cùng hoặc kề ranh giới; dòng dõi có thể bị phản bác, không được bỏ qua | không |
+| `model` | `business.decide`; head mà nhánh đó đã mô hình hoá, khi nó chưa được publish | không |
 
 ## Yêu cầu
 
@@ -80,11 +97,11 @@ chất lượng hay UAT đã qua.
 | --- | --- | --- | --- | --- | --- |
 | 1 | Kiểm gate và chạy lại | `resume`, `approval` | `request/request.json`, đầu vào `architecture-decision` nếu có, @workspaces/be ở head đóng băng | — | `INVALID_INPUT`, `SOURCE_DRIFT`, `NO_PROGRESS` |
 | 2 | Quan sát hiện trạng | — | @workspaces/be ở head đóng băng: manifest, cấu hình, file deploy, @tools/git | `response/data/current-state.json` | `CURRENT_STATE_UNOBSERVED` |
-| 3 | Ràng inventory với lời hứa nghiệp vụ | — | `response/data/current-state.json`, @worktrees/businesses/<featureId> ở head đã publish | — | `BUSINESS_AUTHORITY_REQUIRED`, `EVIDENCE_MISSING` |
+| 3 | Ràng inventory với lời hứa nghiệp vụ | — | `response/data/current-state.json`, đầu vào `model` khi có, nếu không thì @worktrees/businesses/<featureId> ở head đã publish | — | `BUSINESS_AUTHORITY_REQUIRED`, `EVIDENCE_MISSING` |
 | 4 | Đóng khung quyết định | `objective`, `decisionId`, `constraints`, `tradeoffAxes` | phần requirements của `request/request.json` | — | `CONSTRAINT_CONTRADICTION` |
 | 5 | Sinh các phương án | `alternatives` | `response/data/current-state.json`, @knowledge/patterns, @tools/websearch | `response/artifacts/<decisionId>-alternatives.html` chỉ khi được yêu cầu nhiều hơn một phương án, @tools/visualize | `NO_VIABLE_ALTERNATIVE` |
 | 6 | Chọn | `selectionPolicy`, `tradeoffAxes`, `approval` | `response/artifacts/<decisionId>-alternatives.html` khi có | — | `CHOICE_REQUIRED` |
-| 7 | Đào sâu phương án đã chọn | `constraints` | `response/data/current-state.json` | `response/data/stack-model.json` | `DATA_OWNERSHIP_UNASSIGNED`, `COMPATIBILITY_UNVERIFIED` |
+| 7 | Đào sâu phương án đã chọn và khai các operation nó cam kết | `constraints` | `response/data/current-state.json`, ma trận phủ của head nghiệp vụ đã ràng cho các dimension mỗi operation trích dẫn | `response/data/stack-model.json`, gồm cả `operations` của nó | `DATA_OWNERSHIP_UNASSIGNED`, `COMPATIBILITY_UNVERIFIED` |
 | 8 | Chờ phản biện: tạm ngưng, một agent mới tấn công lựa chọn, chạy tiếp khi nó trả lời | — | `critique/response/critique.md` khi cuộc trao đổi done | `response/response.json` (waiting, awaiting critique) | `CRITIQUE_UNRESOLVED` |
 | 9 | Xác nhận hoặc trả lại lựa chọn | `selectionPolicy` | `critique/response/critique.md`, `response/data/stack-model.json` | — | `CHOICE_REQUIRED`, `NO_VIABLE_ALTERNATIVE` |
 | 10 | Viết handoff và phát | — | mọi thứ ở trên | `response/response.md`, `response/response.json` | — |
@@ -92,7 +109,9 @@ chất lượng hay UAT đã qua.
 Với mặc định, bước 5 sinh một thiết kế và không có trang so sánh, bước 6 không có gì để chọn, và
 chất lượng quyết định dựa vào bước 8. Khi phương án duy nhất chết dưới một đòn tấn công, bước 9 dừng
 với `NO_VIABLE_ALTERNATIVE`, không phải `CHOICE_REQUIRED`. Handoff nêu tên contract, không bao giờ
-nêu file implementation, vì chọn file là việc của domain kế tiếp.
+nêu file implementation, vì chọn file là việc của domain kế tiếp; ngoại lệ duy nhất là writer của mỗi
+operation đã khai, cái mà operator này có gọi tên, bởi phần hiện thực không được tự chọn writer cho
+mình.
 
 ## Đầu ra
 

package/operators/architecture-decide/self-test.mjs

@@ -34,6 +34,14 @@ function stackModel({ alternatives = 1 } = {}) {
       { boundaryId: 'course-api', responsibility: 'serves course content', owner: 'learning-team', interfaces: ['CourseQuery'], ownsData: false },
     ],
     stores: [{ storeId: 'entitlement-store', owningBoundaryId: 'entitlement', writers: ['entitlement'], readers: ['course-api'], migrators: ['entitlement'], transactionScope: 'per request', backup: 'nightly snapshot', restore: 'tested weekly', sharedWriteJustification: null }],
+    operations: [
+      {
+        operationId: 'grant-entitlement', name: 'grantEntitlement', transport: 'graphql-mutation',
+        writerRef: 'src/entitlement/graphql/mutations/grant-entitlement.ts', storeRefs: ['entitlement-store'],
+        transactionBoundary: 'single-transaction', idempotencyKind: 'request-token', migrationRefs: [],
+        authorityDimensionIds: ['effective-access'],
+      },
+    ],
     components: [
       { componentId: 'nestjs', status: 'existing', justification: 'observed-evidence', evidence: ev('package.json:12'), compatibility: verdicts() },
       { componentId: 'postgres', status: 'existing', justification: 'measured-constraint', evidence: ev('compose.yaml:30'), compatibility: verdicts() },
@@ -89,6 +97,12 @@ ${altRows.join('\n')}
 | \`postgres\` | existing | measured-constraint | \`compose.yaml:30@${head}\` | 5/5 verified |
 | \`redis-cache\` | removed | — | — | — |
 
+## Operations
+
+| Operation | Transport | Writer | Stores | Transaction | Idempotency | Dimensions |
+| --- | --- | --- | --- | --- | --- | --- |
+| \`grant-entitlement\` | graphql-mutation | \`src/entitlement/graphql/mutations/grant-entitlement.ts\` | \`entitlement-store\` | single-transaction | request-token | effective-access |
+
 ## Handoff
 
 | Item | Kind | Detail |
@@ -148,7 +162,7 @@ function writeBranch(files) {
   const session = mkdtempSync(path.join(tmpdir(), 'arch-session-'));
   const branch = path.join(session, 'step-1', 'parallel-1');
   for (const d of ['request', 'response/data', 'response/artifacts', 'critique/request', 'critique/response']) mkdirSync(path.join(branch, d), { recursive: true });
-  writeFileSync(path.join(session, 'state.json'), JSON.stringify({ id: 's-test', chain: [['1/1']], steps: { '1/1': 'architecture.decide' }, current: '1/1', status: 'running' }));
+  writeFileSync(path.join(session, 'state.json'), JSON.stringify({ id: 's-test', project: 'starci-academy', startedAt: '2026-09-03T00:00:00Z', requestHashes: {}, chain: [['1/1']], steps: { '1/1': 'architecture.decide' }, current: '1/1', status: 'running' }));
   for (const [name, content] of Object.entries(files)) {
     if (content === null) continue;
     writeFileSync(path.join(branch, name), typeof content === 'string' ? content : JSON.stringify(content, null, 2));
@@ -213,6 +227,9 @@ await expectError({ ...baseline(), 'response/data/stack-model.json': { ...stackM
 await expectError({ ...baseline(), 'response/data/stack-model.json': stackModel({ alternatives: 2 }) }, 'but the request asked for 1', 'more alternatives than asked');
 await expectError({ ...baseline(), 'response/response.md': responseMd({ handoffDetail: 'src/entitlement/query.ts returns one answer' }) }, 'names an implementation file', 'handoff names a file');
 await expectError({ ...baseline(), 'response/response.md': responseMd().replace('| Selected alternative | `shared-boundary` |', '| Selected alternative | `edge-cache` |') }, 'Decision names edge-cache', 'response and model disagree on the selection');
+await expectError({ ...baseline(), 'response/data/stack-model.json': (() => { const m = stackModel(); m.operations = [{ ...m.operations[0], storeRefs: ['ghost-store'] }]; return m; })() }, 'which this decision does not own', 'an operation writing a store the decision does not own');
+await expectError({ ...baseline(), 'response/data/stack-model.json': (() => { const m = stackModel(); m.operations = [{ ...m.operations[0], transport: 'event-consumer', idempotencyKind: 'none' }]; return m; })() }, 'a redelivery applies it twice', 'an event consumer with no idempotency');
+await expectError({ ...baseline(), 'response/data/stack-model.json': (() => { const m = stackModel(); m.operations = [{ ...m.operations[0], authorityDimensionIds: ['another-dimension'] }]; return m; })() }, 'does not restate declared dimension another-dimension', 'a receipt that drops a declared dimension');
 await expectError({ ...baseline(), 'response/response.md': responseMd().replace('## Handoff', '## Hand-off') }, 'missing section ^## Handoff$', 'response section renamed');
 await expectError({ ...baseline(), 'response/data/current-state.json': { ...currentState(), observedHead: 'nope' } }, 'observedHead', 'current-state schema');
 await expectError({ ...baseline(), 'response/response.json': (() => { const o = responseJson(); delete o.fields['stack-model']; return o; })() }, 'required output stack-model is not in fields', 'missing required output');

package/operators/architecture-decide/validate.mjs

@@ -4,7 +4,8 @@
 // owner among its writers and shared writes are justified; retained components are verified on all
 // five axes or carry the COMPATIBILITY_UNVERIFIED fallback; the critique came from the nested
 // exchange, attacks the selected alternative, and a failing attack cannot end in status done; the
-// handoff names contracts, never implementation files.
+// handoff names contracts, never implementation files; every declared operation is named once, names a
+// writer, cites at least one business dimension, and is restated by the receipt's Operations table.
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
@@ -62,6 +63,14 @@ export async function validateArchitectureStep(branchDir, root = ROOT) {
       if (b.ownsData && n === 0) errors.push(`response/data/stack-model.json: boundary ${b.boundaryId} claims data and owns no store`);
       if (!b.ownsData && n > 0) errors.push(`response/data/stack-model.json: boundary ${b.boundaryId} claims no data and owns ${n} store(s)`);
     }
+    const seenOperations = new Set();
+    for (const o of model.operations ?? []) {
+      if (seenOperations.has(o.operationId)) errors.push(`response/data/stack-model.json: operation ${o.operationId} is declared twice`);
+      seenOperations.add(o.operationId);
+      for (const storeRef of o.storeRefs) if (!model.stores.some((st) => st.storeId === storeRef)) errors.push(`response/data/stack-model.json: operation ${o.operationId} names store ${storeRef}, which this decision does not own`);
+      if (o.transactionBoundary === 'read-only' && o.migrationRefs.length) errors.push(`response/data/stack-model.json: operation ${o.operationId} is read-only and ships a migration`);
+      if (o.transport === 'event-consumer' && o.idempotencyKind === 'none') errors.push(`response/data/stack-model.json: operation ${o.operationId} consumes events with no idempotency, so a redelivery applies it twice`);
+    }
     const fallbacks = new Set(response.fallbacks ?? []);
     for (const c of model.components) {
       if (c.status === 'removed') { if (c.compatibility.length) errors.push(`response/data/stack-model.json: removed component ${c.componentId} carries a compatibility verdict`); continue; }
@@ -81,6 +90,25 @@ export async function validateArchitectureStep(branchDir, root = ROOT) {
     if (!empty(requirements.decisionId) && decision['Decision id'] !== requirements.decisionId) errors.push('response/response.md: Decision id differs from the request');
     const alts = tableUnder(text, '## Alternatives') ?? [];
     if (model && alts.length !== model.alternatives.length) errors.push(`response/response.md: Alternatives has ${alts.length} rows, stack-model has ${model.alternatives.length}`);
+    const operationRows = tableUnder(text, '## Operations') ?? [];
+    if (model) {
+      const declared = new Map((model.operations ?? []).map((o) => [o.operationId, o]));
+      if (operationRows.length !== declared.size) errors.push(`response/response.md: Operations has ${operationRows.length} rows, stack-model declares ${declared.size}`);
+      for (const [operationId, transport, writer, stores, transaction, idempotency, dimensions] of operationRows) {
+        const id = String(operationId).replace(/`/g, '');
+        const o = declared.get(id);
+        if (!o) { errors.push(`response/response.md: Operations names ${id}, which stack-model does not declare`); continue; }
+        if (transport !== o.transport) errors.push(`response/response.md: operation ${id} reports transport ${transport}, stack-model declares ${o.transport}`);
+        if (String(writer).replace(/`/g, '') !== o.writerRef) errors.push(`response/response.md: operation ${id} names another writer than stack-model`);
+        if (transaction !== o.transactionBoundary) errors.push(`response/response.md: operation ${id} reports transaction ${transaction}, stack-model declares ${o.transactionBoundary}`);
+        if (idempotency !== o.idempotencyKind) errors.push(`response/response.md: operation ${id} reports idempotency ${idempotency}, stack-model declares ${o.idempotencyKind}`);
+        const cited = String(dimensions).split(',').map((v) => v.trim().replace(/`/g, '')).filter(Boolean);
+        for (const dimensionId of cited) if (!o.authorityDimensionIds.includes(dimensionId)) errors.push(`response/response.md: operation ${id} cites dimension ${dimensionId}, which stack-model does not declare`);
+        for (const dimensionId of o.authorityDimensionIds) if (!cited.includes(dimensionId)) errors.push(`response/response.md: operation ${id} does not restate declared dimension ${dimensionId}`);
+        const declaredStores = String(stores).split(',').map((v) => v.trim().replace(/`/g, '')).filter((v) => v && v !== '—');
+        for (const storeRef of o.storeRefs) if (!declaredStores.includes(storeRef)) errors.push(`response/response.md: operation ${id} does not restate store ${storeRef}`);
+      }
+    }
     for (const [item, kind, detail] of tableUnder(text, '## Handoff') ?? []) if (kind === 'contract' && IMPLEMENTATION_FILE.test(detail)) errors.push(`response/response.md: handoff contract "${item}" names an implementation file`);
     for (const [component, status] of tableUnder(text, '## Stack delta') ?? []) if (status === 'replaced-candidate' && !(response.fallbacks ?? []).includes('COMPATIBILITY_UNVERIFIED')) errors.push(`response/response.md: ${component} is replaced-candidate without the COMPATIBILITY_UNVERIFIED fallback`);
   }

package/operators/backend-source-apply/operator.md

@@ -1,189 +1,204 @@
-# backend.source.apply
-
-## Job
-
-Implement one backend outcome inside a frozen mutation contract, following the observed sibling
-family, and return the measured conformance and proof receipt that shows the boundary was not widened.
-
-## The contract is frozen before the first write
-
-The contract arrives as the Input `architecture-decision`, fingerprinted and closed. The operations,
-writers, stores, transaction boundaries, idempotency kinds, and migrations it lists are the complete
-set the implementation may touch, and this operator answers only one question per operation: does the
-code that now exists do exactly what the contract says, and what measurement shows it. The operations
-are not a Requirement, because a person retyping a contract into a request is how the contract and
-the implementation quietly diverge; step 3 reads them from the frozen input and restates them in
-`response/data/mutations.json`. Three prohibitions carry that, and each is enforced rather than
-advised. An operation, writer, store, transaction, migration, or event outside the contract is
-`CONTRACT_WIDENED`, returned to the contract owner before any product write. A file outside the
-mutable ceiling is `OWNER_CONFLICT`, even when the change there would be one line. A convention no
-bound sibling pattern publishes is refused and recorded as `NEW_CONVENTION_REFUSED`, while an aspect
-with no pattern at all is `PATTERN_UNBOUND`. Discovering mid-implementation that the outcome needs a
-wider boundary is the expected way this operator ends, not a failure of nerve: the contract is
-reopened by its owner and the same outcome is implemented again against the new fingerprint. Reaching
-outside the list is not a smaller change than reopening the contract; it is the same change made
-without a record.
-
-## The person's branch is never written
-
-This operator never writes on the branch a person has checked out. The orchestrator prepares a
-dedicated git worktree of the routed checkout on the session branch `session/<sessionId>`, cut from
-the frozen head, and step 3 writes there and nowhere else, under an exclusive lease on
-`@workspaces/be`. The final step commits the whole declared write set once, records that sha in
-`response.json.commits`, and names the same sha in `response/data/mutations.json` as `commit` beside
-the `base` it started from and the `branch` it lives on; `response/changes.md` states the same move in
-its Binding row, `@workspaces/be` at `<base>` → `<sha>` on `session/<sessionId>`. One commit, because
-a step whose work arrives as several commits cannot be pinned by the next step's request, and an
-uncommitted write cannot be pinned at all. Nothing is pushed and nothing is merged here: `git.publish`
-merges the session branch into the target branch, and it is the only operator that talks to a remote.
-
-## Dry mode writes the plan, not the tree
-
-`mode` decides whether this run touches the checkout at all. Under `apply` the operator fills the
-contract, commits once, and everything below holds as written. Under `dry` it does the same reading,
-the same binding and the same projection, then stops after the plan: `response/data/mutations.json`
-carries the operations it would fill and the files it would touch with `commit` null and no after
-hash, `response.json` records no commit, and not one byte reaches `@workspaces/be`. The branch still
-ends `done`, because a plan honestly produced is a finished answer to a question about a plan; its
-`changes.md` lists every planned path as `unchanged`, which is what the working tree actually shows,
-and names the change it would have made in `Why`. A dry run measures nothing, so it carries no
-conformance record and no proof record: a facet cannot be measured on code that was never written,
-and a plan that shipped verdicts would be indistinguishable from an implementation. That is also why
-a dry run can never be the run that satisfies the contract — it is a way to read the write set before
-paying for it, not a cheaper way to apply it.
-
-## The backend never invents business behaviour
-
-Every operation cites the approved decisions it implements. When the code reaches a point where the
-answer depends on a business rule nobody approved, the branch stops with `BUSINESS_AUTHORITY_MISSING`
-and names the open question. It does not pick the lenient reading, mirror what a neighbouring feature
-happens to do, or choose whichever branch makes the test go green. This is the most load-bearing rule
-in the operator, because a guessed business rule that passes its own test is indistinguishable from an
-approved one once it ships. An implemented receipt therefore cannot carry a `BUSINESS_QUESTION_RAISED`
-finding: raising the question and implementing anyway is the exact contradiction the check exists to
-catch.
-
-## Sibling patterns are the only source of convention
-
-The bound patterns name one family per aspect, and the implementation mirrors the family the codebase
-already publishes rather than the one it remembers: command handlers in the family the mutation layer
-already uses, exceptions derived from the published exception identity, entity access through the
-injected primary entity manager, migrations under the primary datasource. Two families bound for one
-aspect means no family is bound, and guessing the family from memory is how a second house style
-enters a codebase unnoticed.
-
-## Conformance is measured, not asserted
-
-A conformance record without evidence is a sentence about the code, and a sentence cannot contradict
-the code. Each declared facet of each operation gets its own file,
-`response/data/conformance/<operationId>.<facet>.json`, so a facet nobody measured is a missing file
-rather than a missing line inside a file that still looks complete. The evidence is what a later
-reader uses to disagree with this receipt, so it is required for every facet including the ones that
-passed. The same reasoning makes a proof carry its command, its exit code and its output in
-`response/data/proofs/<operationId>.<kind>.json`: the command says what was run and the result says
-what came back, and either one alone can be written by someone who ran nothing. A proof that could not
-run never becomes an assertion that the behaviour is fine, and a failed proof blocks the receipt
-rather than being reclassified. Each touched file carries one change record with its kind and its
-before and after hashes, because a modified file whose two hashes agree records a mutation that did
-not happen.
-
-## Boundary
-
-The operator writes product source only inside the mutable file ceiling, only inside the session
-branch worktree of `@workspaces/be`, and writes everything else into `response/` of its own branch:
-`response.md`, `response/changes.md`, `response/data/mutations.json`, one conformance record per
-declared facet, one proof record per declared proof, and `response.json`. It never adds an operation,
-writer, store, transaction, migration, or event the frozen contract does not carry, decides a business
-rule the approved authority does not state, introduces a convention no bound sibling pattern
-publishes, weakens, skips, suppresses, or substitutes a declared proof to make a run go green, edits
-the contract, the business authority, or a file outside the mutable ceiling, commits more than once,
-writes on the person's checked-out branch, pushes, merges, or tags anything, claims conformance
-without naming the evidence that measured it, or records a quality, visual, or UAT verdict; those are
-other jobs with their own gates.
-
-## Context
-
-| Alias | Bind | Required |
-| --- | --- | --- |
-| `@worktrees/businesses/<featureId>` | the published business head, the only source of business behaviour | yes |
-| `@knowledge/patterns/be` | the sibling families this change mirrors, one per aspect; the only source of valid conventions | yes |
-| `@workspaces/be` | the routed backend checkout at the frozen head, written only on its session branch worktree | yes |
-
-## Inputs
-
-| Kind | From | Required |
-| --- | --- | --- |
-| `architecture-decision` | `architecture.decide`; the frozen mutation contract the implementation fills and may not widen | yes |
-| `backend-source-application` | a prior run of `backend.source.apply` for the same outcome; regression history, absent on the first run | no |
-
-## Requirements
-
-| Field | Type | Default | Ask |
-| --- | --- | --- | --- |
-| `featureId` | id | — | The feature whose published business head decides this behaviour |
-| `outcome` | prompt | — | The one thing being implemented, in the person's words |
-| `mutableFileRefs` | list | — | The only files product source may be written into |
-| `mode` | choice | apply | `apply` fills the contract and commits, `dry` emits the plan and writes nothing |
-| `resume` | token | null | The blocked branch's token when re-entering after a stop |
-
-## Steps
-
-| # | Step | Params | Reads | Writes | Stops with |
-| --- | --- | --- | --- | --- | --- |
+# backend.source.apply
+
+## Job
+
+Implement one backend outcome inside a frozen mutation contract, following the observed sibling
+family, and return the measured conformance and proof receipt that shows the boundary was not widened.
+
+## The contract is frozen before the first write
+
+The contract arrives as the Input `architecture-decision`, fingerprinted and closed. The operations,
+writers, stores, transaction boundaries, idempotency kinds, and migrations it lists are the complete
+set the implementation may touch, and this operator answers only one question per operation: does the
+code that now exists do exactly what the contract says, and what measurement shows it. The operations
+are not a Requirement, because a person retyping a contract into a request is how the contract and
+the implementation quietly diverge; step 3 reads them from the frozen input's `operations` — one row of the
+architecture decision's `## Operations` table, one object of its `stack-model.json`, per write the
+decision commits to — and restates them in `response/data/mutations.json`, carrying each operation's
+`writerRef`, `transactionBoundary`, `idempotencyKind`, `migrationRefs` and dimension ids across
+unchanged. Three prohibitions carry that, and each is enforced rather than
+advised. An operation, writer, store, transaction, migration, or event outside the contract is
+`CONTRACT_WIDENED`, returned to the contract owner before any product write. A file outside the
+mutable ceiling is `OWNER_CONFLICT`, even when the change there would be one line. A convention no
+bound sibling pattern publishes is refused and recorded as `NEW_CONVENTION_REFUSED`, while an aspect
+with no pattern at all is `PATTERN_UNBOUND`. Discovering mid-implementation that the outcome needs a
+wider boundary is the expected way this operator ends, not a failure of nerve: the contract is
+reopened by its owner and the same outcome is implemented again against the new fingerprint. Reaching
+outside the list is not a smaller change than reopening the contract; it is the same change made
+without a record.
+
+## The person's branch is never written
+
+This operator never writes on the branch a person has checked out. The orchestrator prepares a
+dedicated git worktree of the routed checkout on the session branch `session/<sessionId>`, cut from
+the frozen head, and step 3 writes there and nowhere else, under an exclusive lease on
+`@workspaces/be`. The final step commits the whole declared write set once, records that sha in
+`response.json.commits`, and names the same sha in `response/data/mutations.json` as `commit` beside
+the `base` it started from and the `branch` it lives on; `response/changes.md` states the same move in
+its Binding row, `@workspaces/be` at `<base>` → `<sha>` on `session/<sessionId>`. One commit, because
+a step whose work arrives as several commits cannot be pinned by the next step's request, and an
+uncommitted write cannot be pinned at all. Nothing is pushed and nothing is merged here: `git.publish`
+merges the session branch into the target branch, and it is the only operator that talks to a remote.
+
+## Dry mode writes the plan, not the tree
+
+`mode` decides whether this run touches the checkout at all. Under `apply` the operator fills the
+contract, commits once, and everything below holds as written. Under `dry` it does the same reading,
+the same binding and the same projection, then stops after the plan: `response/data/mutations.json`
+carries the operations it would fill and the files it would touch with `commit` null and no after
+hash, `response.json` records no commit, and not one byte reaches `@workspaces/be`. The branch still
+ends `done`, because a plan honestly produced is a finished answer to a question about a plan; its
+`changes.md` lists every planned path as `unchanged`, which is what the working tree actually shows,
+and names the change it would have made in `Why`. A dry run measures nothing, so it carries no
+conformance record and no proof record: a facet cannot be measured on code that was never written,
+and a plan that shipped verdicts would be indistinguishable from an implementation. A dry run is also granted neither `@tools/sourcewrite` nor `@tools/git`, because a
+mode that writes nothing needs no tool that can write; the grant and this paragraph say the same
+thing so neither can drift. That is also why
+a dry run can never be the run that satisfies the contract — it is a way to read the write set before
+paying for it, not a cheaper way to apply it.
+
+## The backend never invents business behaviour
+
+Every operation cites the approved decisions it implements. An approved decision is not a number this
+operator may coin: it is a coverage-matrix `dimension` of the bound business head, addressed by that
+dimension's own kebab identifier, and the matrix fingerprint travels with the citation so a later
+reader can tell which matrix approved it. A citation naming anything the bound matrix does not carry
+is not an approval, it is a guess with a label. When the code reaches a point where the
+answer depends on a business rule nobody approved, the branch stops with `BUSINESS_AUTHORITY_MISSING`
+and names the open question. It does not pick the lenient reading, mirror what a neighbouring feature
+happens to do, or choose whichever branch makes the test go green. This is the most load-bearing rule
+in the operator, because a guessed business rule that passes its own test is indistinguishable from an
+approved one once it ships. An implemented receipt therefore cannot carry a `BUSINESS_QUESTION_RAISED`
+finding: raising the question and implementing anyway is the exact contradiction the check exists to
+catch.
+
+## Sibling patterns are the only source of convention
+
+The bound patterns name one family per aspect, and the implementation mirrors the family the codebase
+already publishes rather than the one it remembers: command handlers in the family the mutation layer
+already uses, exceptions derived from the published exception identity, entity access through the
+injected primary entity manager, migrations under the primary datasource. Two families bound for one
+aspect means no family is bound, and guessing the family from memory is how a second house style
+enters a codebase unnoticed.
+
+## Conformance is measured, not asserted
+
+A conformance record without evidence is a sentence about the code, and a sentence cannot contradict
+the code. Each declared facet of each operation gets its own file,
+`response/data/conformance/<operationId>.<facet>.json`, so a facet nobody measured is a missing file
+rather than a missing line inside a file that still looks complete. The evidence is what a later
+reader uses to disagree with this receipt, so it is required for every facet including the ones that
+passed. The same reasoning makes a proof carry its command, its exit code and its output in
+`response/data/proofs/<operationId>.<kind>.json`: the command says what was run and the result says
+what came back, and either one alone can be written by someone who ran nothing. A proof that could not
+run never becomes an assertion that the behaviour is fine, and a failed proof blocks the receipt
+rather than being reclassified. Each touched file carries one change record with its kind and its
+before and after hashes, because a modified file whose two hashes agree records a mutation that did
+not happen.
+
+## Boundary
+
+The operator writes product source only inside the mutable file ceiling, only inside the session
+branch worktree of `@workspaces/be`, and writes everything else into `response/` of its own branch:
+`response.md`, `response/changes.md`, `response/data/mutations.json`, one conformance record per
+declared facet, one proof record per declared proof, and `response.json`. It never adds an operation,
+writer, store, transaction, migration, or event the frozen contract does not carry, decides a business
+rule the approved authority does not state, introduces a convention no bound sibling pattern
+publishes, weakens, skips, suppresses, or substitutes a declared proof to make a run go green, edits
+the contract, the business authority, or a file outside the mutable ceiling, commits more than once,
+writes on the person's checked-out branch, pushes, merges, or tags anything, claims conformance
+without naming the evidence that measured it, or records a quality, visual, or UAT verdict; those are
+other jobs with their own gates.
+
+When the `model` Input is present it is the authority for this run and the published head is lineage
+only: a chain that has just modelled a head must not decide against an older promise merely because
+the publication was withheld. When it is absent the published head is the authority.
+
+## Context
+
+| Alias | Bind | Required |
+| --- | --- | --- |
+| `@worktrees/businesses/<featureId>` | the published business head, the only source of business behaviour; evidence when the session carries a `model` Input | yes |
+| `@knowledge/patterns/be` | the sibling families this change mirrors, one per aspect; the only source of valid conventions | yes |
+| `@workspaces/be` | the routed backend checkout at the frozen head, written only on its session branch worktree | yes |
+
+## Inputs
+
+| Kind | From | Required |
+| --- | --- | --- |
+| `architecture-decision` | `architecture.decide`; the frozen mutation contract the implementation fills and may not widen, and the source of every operation this run restates | yes |
+| `model` | `business.decide`; the head that branch modelled, when it has not been published yet | no |
+| `backend-source-application` | a prior run of `backend.source.apply` for the same outcome; regression history, absent on the first run | no |
+
+## Requirements
+
+| Field | Type | Default | Ask |
+| --- | --- | --- | --- |
+| `featureId` | id | — | The feature whose published business head decides this behaviour |
+| `outcome` | prompt | — | The one thing being implemented, in the person's words |
+| `mutableFileRefs` | list | — | The only files product source may be written into |
+| `mode` | choice | apply | `apply` fills the contract and commits, `dry` emits the plan and writes nothing |
+| `resume` | token | null | The blocked branch's token when re-entering after a stop |
+
+## Steps
+
+| # | Step | Params | Reads | Writes | Stops with |
+| --- | --- | --- | --- | --- | --- |
 | 1 | Validate the gate and resume | `resume`, `mode` | `request/request.json`, input `backend-source-application` when present, @workspaces/be at the frozen head | — | `INVALID_INPUT`, `SOURCE_DRIFT`, `NO_PROGRESS` |
-| 2 | Bind authority, contract and patterns | `featureId` | @worktrees/businesses/<featureId> at its published head, input `architecture-decision` as the frozen contract, @knowledge/patterns/be one pattern per aspect | — | `CONTRACT_UNFROZEN`, `BUSINESS_AUTHORITY_MISSING`, `PATTERN_UNBOUND` |
+| 2 | Bind authority, contract and patterns | `featureId` | input `model` when present, otherwise @worktrees/businesses/<featureId> at its published head, input `architecture-decision` as the frozen contract and the source of its `operations`, @knowledge/patterns/be one pattern per aspect | — | `CONTRACT_UNFROZEN`, `BUSINESS_AUTHORITY_MISSING`, `PATTERN_UNBOUND` |
 | 3 | Fill one contract operation at a time, on the session branch | `mutableFileRefs` | @knowledge/patterns/be for each aspect, @workspaces/be inside the mutable ceiling | @workspaces/be/branch/session inside the mutable ceiling, under an exclusive lease, @tools/sourcewrite | `CONTRACT_WIDENED`, `OWNER_CONFLICT` |
 | 4 | Check every mutation against the frozen contract and record it with its before and after hash | `mode` | @workspaces/be, the touched files and the frozen contract | `response/data/mutations.json` | — |
 | 5 | Revalidate persisted snapshots on read | — | @workspaces/be, the persisted snapshot, @knowledge/patterns/be for the rules that drift after it | — | — |
 | 6 | Prove each declared facet | — | @workspaces/be, the measurement behind each facet | `response/data/conformance/<operationId>.<facet>.json` | — |
 | 7 | Run each declared proof | — | @workspaces/be, the pinned command of each declared proof kind | `response/data/proofs/<operationId>.<proofKind>.json`, @tools/shell | `PROOF_UNAVAILABLE` |
 | 8 | Commit the write set once, write the receipt and emit | `outcome` | everything above | @workspaces/be/branch/session as one commit, `response/changes.md`, `response/response.md`, `response/response.json`, @tools/git | — |
-
-Under `mode = dry` step 3 projects the fill onto the declared paths without writing one of them, step
-4 records that projection as the plan with a null commit and no after hash, steps 5 to 7 have nothing
-to measure and produce nothing, and step 8 emits the receipt and the change record without a commit.
-Under `apply` every step runs as written. The routed head is reverified immediately before the first
-product write, so drift found there stops the branch before anything is written. Filling an operation writes the transport, the validation, the
-authorization check, the data access, and the failure paths into the declared writer and the files the
-change genuinely requires; it refuses loudly and early rather than dropping a case silently, raising
-the exception the exception-identity pattern publishes before any row or external checkout is created.
-When the outcome persists a workflow, session, cart, draft, or other snapshot, usability is enforced
-again where it is read, reconciled server side, in stable order, with indexes remapped atomically and
-an explicit terminal state when nothing actionable remains, and recorded as `SNAPSHOT_REVALIDATED`. A
-resume begins again at step 1, reuses only unchanged fingerprinted observations, and consumes the exact
-delta; an approved business decision arrives as a new authority fingerprint, because the same
-fingerprint cannot yield a different answer.
-
-## Outputs
-
-| Kind | File | Type | Required |
-| --- | --- | --- | --- |
-| `backend-source-application` | `response/response.md` | md | yes |
-| `changes` | `response/changes.md` | md | yes |
-| `mutations` | `response/data/mutations.json` | data | yes |
-| `conformance` | `response/data/conformance/<operationId>.<facet>.json` | data | no |
-| `proof` | `response/data/proofs/<operationId>.<proofKind>.json` | data | no |
-
-## Stops
-
-| Code | Disposition |
-| --- | --- |
-| `INVALID_INPUT` | terminate |
-| `SOURCE_DRIFT` | terminate |
-| `NO_PROGRESS` | terminate |
-| `CONTRACT_UNFROZEN` | terminate |
-| `CONTRACT_WIDENED` | terminate |
-| `BUSINESS_AUTHORITY_MISSING` | terminate |
-| `OWNER_CONFLICT` | terminate |
-| `PATTERN_UNBOUND` | terminate |
-| `PROOF_UNAVAILABLE` | terminate |
-
-## Next
-
-| When | Operator |
-| --- | --- |
-| the contract is filled and the gates the change record names must run | `quality.verify` |
-| the promise must be reconciled against the source that was delivered | `business.decide` |
-| the contract is filled and a frontend surface must consume it | `frontend.direction.decide` |
-| a file needing mutation lies outside the routed write ceiling | `workspace.bind` |
-| a declared proof cannot be executed in this environment | `platform.operate` |
+
+Under `mode = dry` step 3 projects the fill onto the declared paths without writing one of them, step
+4 records that projection as the plan with a null commit and no after hash, steps 5 to 7 have nothing
+to measure and produce nothing, and step 8 emits the receipt and the change record without a commit.
+Under `apply` every step runs as written. The routed head is reverified immediately before the first
+product write, so drift found there stops the branch before anything is written. Filling an operation writes the transport, the validation, the
+authorization check, the data access, and the failure paths into the declared writer and the files the
+change genuinely requires; it refuses loudly and early rather than dropping a case silently, raising
+the exception the exception-identity pattern publishes before any row or external checkout is created.
+When the outcome persists a workflow, session, cart, draft, or other snapshot, usability is enforced
+again where it is read, reconciled server side, in stable order, with indexes remapped atomically and
+an explicit terminal state when nothing actionable remains, and recorded as `SNAPSHOT_REVALIDATED`. A
+resume begins again at step 1, reuses only unchanged fingerprinted observations, and consumes the exact
+delta; an approved business decision arrives as a new authority fingerprint, because the same
+fingerprint cannot yield a different answer.
+
+## Outputs
+
+| Kind | File | Type | Required |
+| --- | --- | --- | --- |
+| `backend-source-application` | `response/response.md` | md | yes |
+| `changes` | `response/changes.md` | md | yes |
+| `mutations` | `response/data/mutations.json` | data | yes |
+| `conformance` | `response/data/conformance/<operationId>.<facet>.json` | data | no |
+| `proof` | `response/data/proofs/<operationId>.<proofKind>.json` | data | no |
+
+## Stops
+
+| Code | Disposition |
+| --- | --- |
+| `INVALID_INPUT` | terminate |
+| `SOURCE_DRIFT` | terminate |
+| `NO_PROGRESS` | terminate |
+| `CONTRACT_UNFROZEN` | terminate |
+| `CONTRACT_WIDENED` | terminate |
+| `BUSINESS_AUTHORITY_MISSING` | terminate |
+| `OWNER_CONFLICT` | terminate |
+| `PATTERN_UNBOUND` | terminate |
+| `PROOF_UNAVAILABLE` | terminate |
+
+## Next
+
+| When | Operator |
+| --- | --- |
+| the contract is filled and the gates the change record names must run | `quality.verify` |
+| the promise must be reconciled against the source that was delivered | `business.decide` |
+| the contract is filled and a frontend surface must consume it | `frontend.direction.decide` |
+| a file needing mutation lies outside the routed write ceiling | `workspace.bind` |
+| a declared proof cannot be executed in this environment | `platform.operate` |
+| the plan was produced under mode dry and a person decides whether to pay for it | `user` |