Core Promotion Review
Use this review before moving module behavior into src/. A similar class name,
table shape, or framework precedent is not evidence of a shared k0smos domain.
Required Decision Record
Copy this section into the durable architecture document owned by the change.
- Capability and proposed core contract — name the provider-neutral behavior and the smallest public interface.
- Consumer A — name an active consumer, its current owner, invariants, and lifecycle.
- Consumer B — name a second active consumer and prove its semantics match Consumer A, including tenancy, identity, authorization, concurrency, retention/deletion, and error behavior.
- Ownership — state what core owns and what each module continues to own. Core must not query an optional module's tables.
- Optionality proof — show core boots and the contract remains valid with either or both consumers inactive.
- Verification — name contract tests, module integration tests, and static dependency/DI ownership checks.
- Migration — define forward migration, compatibility window, rollback, export/reimport behavior, and failure recovery.
- Alternatives — compare local duplication for now, a private shared library, an event/integration contract, and a core service.
- Decision — accept, reject, or defer, with owner and review trigger.
An explicit user-approved exception may replace the second consumer, but the record must identify that exception and retain every other section.
Current Reviews
| Candidate | Named consumers/evidence | Decision |
|---|---|---|
| Structured document extraction and byte inspection | Ai private attachments and Discovery Media evidence share checksum, format, bounded execution and cancellation semantics. | Accept; src/App/AI/Document/AI.DocumentExtraction.md. |
| Shared AI activation | Ai private chat and Discovery reuse tenant providers/Python execution with independent state. | Accept; src/App/AI/AI.SharedAi.md. |
| Sensitive HTTP content exclusion | Ai and Discovery need identical early telemetry exclusion without sharing content. | Accept; src/Http/Privacy/AI.RequestPrivacy.md. |
| Committed content changes | Ecommerce catalog projection handoff and Discovery freshness share tenant identity, commit, retry and revocation semantics. | Accept; bounded identity outbox and recovery only. Decision: src/Application/ContentChange/AI.ContentChange.md. |
| EasyStore import runs | Esapi is the only EasyStore consumer. Psapi and Wpapi have durable runs, but their vendor contracts, checkpoints, entity graphs, and reconciliation rules differ. | Reject promotion; reuse small HTTP/merge contracts only. |
| Core taxonomy | Kit, Finance, Ticket, Wpapi, and Ecommerce fail the semantic match documented in ADR 0001; Blog/Page have no native assignments. | Reject; keep bounded models. |
| Vector projection | Search documents and Ecommerce catalog projections are possible inputs, not two proven consumers of a stable vector lifecycle. | Defer until two retrieval use cases define matching freshness, deletion, ACL, and rebuild rules. |
| Graph projection | No two runtime consumers or provider-neutral traversal contract exist. Repository-analysis notes are unrelated. | Reject current promotion. |
| Signage content providers | No accepted signage bounded context or two content providers with a shared lifecycle exist. | Defer pending product scope and named consumers. |
ArchitectureBoundaryTest protects the new module-neutral core contracts and migration-only DDL. DefinitionGroupCollisionTest prevents modules from replacing core DI keys or each other. These are ratchets: accepted promotions add their new core path to the module-neutral boundary list.