Repository navigation
Architecture
Source baseline: 533d8acfddb1ffdf01700d80a42ba649120a902e. This index describes current contracts and stable ownership. Runtime acceptance is tied to a specific commit and report; historical results do not certify today's code. See #2325 for this change and its evidence.
Prefer established algorithms, data structures and mathematical models, using existing PostgreSQL, Rust, Node.js and shared SDK capabilities. Do not infer business capacity from assumed client behavior or a development machine. Preserve functionality before reliability, performance and extensibility. Reducing a page's size must not remove access to subsequent pages.
The Host and shared SDK own generic message dispatch, child-process notifications, cancellation and lifecycle management. Plugins own their business/provider adaptation.
HTTP / SSE / WebSocket / MCP
-> protocol parsing and authentication (credential boundary)
-> Canonical Interface / frozen invocation plan
-> typed Handler -> Control Plane / Orchestration
-> PostgreSQL: transactions, facts, Outbox and history
-> RuntimeExtensionHost -> shared SDK -> plugin -> upstream
Business commit, invocation terminal, protocol delivery and subscriber ACK are separate states. Disconnection does not prove business cancellation; enqueueing does not prove commit or successful handling.
Protocol adapters consume compiled registries, bindings and authorization projections. Calls freeze identity instead of assembling routes dynamically. UI visibility is not authorization.
HostExtensions are trusted startup extensions. RuntimeExtension and CapabilityPlugin contributions use managed transports and supported contracts. Managed subscribers support Invocation / WorkspaceAssignment scopes with exact event contract/version and contribution grants; User scope is not open and authentication factories remain trusted Host responsibilities.
Governance history uses keyset continuation, preserving deliveries and deliveries_truncated and adding next_cursor. The default 256 candidates is a page size, not a history limit. Continue even after a filtered empty page if a cursor remains. Cursors bind installation/workspace and grant no authority.
Current workspace snapshots, retained snapshots, frozen references and retirement markers no longer reject work at arbitrary 256/4096 counts. Closing, reference draining, explicit retirement and durable-backlog checks remain. Markers prevent shared-generation resurrection and remain until Host shutdown; they are not evicted by count. This is not a constant-memory guarantee. Other execution-lane concurrency, frame protections and shutdown budgets remain separate controls and were not comprehensively redesigned here.
- Runtime Backend and its six Ports (Chinese)
- AI Gateway observation (Chinese)
- Hot replay and cold recovery
The sole composition root, api-server, owns an in-process Host. Business code uses stable Ports; Host/SDK own worker correlation, backpressure, cancellation and exit. Gateway protocol mapping, AI Native execution and provider adaptation remain separate.
Required facts must commit before the matching generation terminal and reclamation proof. A background flush timer is not a commit barrier. Cold recovery reads existing durable facts without repeating completed tools or making each plugin implement Host logging and recovery infrastructure.
- PostgreSQL trees and cursor pagination
- MCP return controls (Chinese)
- Orchestration diagnostics
- Schema UI layering (Chinese)
The backend owns data, permissions and state. Frontends consume canonical DTO field names without output compatibility layers. PostgreSQL handles transactions and relational queries; pagination and on-demand details preserve complete access. Outbox claiming and fencing retain their transaction owner rather than relying on a new message broker to establish correctness.
The repository index contains current topics. Archives preserve historical scope, commands and candidate evidence. Research is not an implementation claim. Documentation publication is separate from deployment; #2325 records the frozen candidate and centralized QA.
Acceptance: CI 38019783631: 73 Rust tests and 8 Node tests passed. This evidence covers the finite #2325 matrix, not full-repository or production-deployment acceptance.
The repository index separates current contracts, research and historical evidence. Phase permissions belong to lifecycle contracts; diagnostic capture belongs to AI Gateway evidence. Research adoption notes and the #2228 evidence index retain their historical scope. This documentation update does not claim a new product test run.