1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
# Codegen policy for inventory.
#
# `user_owned` globs are hand-written files that live inside generator-owned trees but are
# NOT schema-derived. `metaphor schema generate [--force]` skips them wholesale (never reads,
# merges, or deletes them). Everything else in src/ is regenerated from schema/models.
#
# Re-exports/declarations that must sit alongside generated code live inside
# `// <<< CUSTOM ... // END CUSTOM` markers (service/mod.rs, presentation/http/mod.rs, lib.rs)
# and are preserved by the marker mechanism, not listed here.
#
# Add your hand-authored services, handlers, tests, and docs below as you write them.
user_owned:
# The composer-installed request-pool shim the write service resolves its database
# through (ADR-0029 pool law): hand-written, never schema-derived.
- "src/request_pool.rs"
# The create_backorder policy enum: the generator emits it from schema/models/operation.model.yaml,
# but a mid-change regen would also re-derive entity/migration files this convergence pass keeps
# hand-owned — so the file is frozen here and mirrors the schema's enum values exactly
# (ask / always / delayed / never; delayed = mint the backorder but defer its reservation).
- "src/domain/entity/create_backorder.rs"
# Domain events (public extension surface) + GL-posting port + valuation engine/write path
# + the availability read-model + the DeliveryRequested intake.
- "src/application/service/inventory_events.rs"
- "src/application/service/inventory_gl.rs"
- "src/application/service/inventory_write_service.rs"
# The write surface, chunked out of inventory_write_service.rs. Each is an `impl
# InventoryWriteService` block; the shared vocabulary (input structs, outcomes, errors) stays
# in inventory_write_service.rs.
- "src/application/service/inventory_masters.rs"
- "src/application/service/inventory_receipt.rs"
- "src/application/service/inventory_delivery.rs"
- "src/application/service/inventory_transfer.rs"
- "src/application/service/inventory_reconciliation.rs"
- "src/application/service/inventory_read.rs"
- "src/application/service/inventory_intake.rs"
# The two-scope availability read (display vs checkout) at one warehouse pivot: the
# AvailabilityScopePort contract with its refusing default, the database-backed read,
# and the DTOs. Pure reads over the quant reservation triangle — nothing persisted.
- "src/application/service/availability_scope.rs"
# The store-level reservation ledger: hold/release/consume/sweep verbs over
# inventory.stock_reservations, plus its repository.
- "src/application/service/inventory_reservation.rs"
- "src/infrastructure/persistence/stock_reservation_repository.rs"
# The converged stock-move engine (_action_confirm / _action_assign / _action_done /
# _action_cancel) over quant-grain reservation — the stock-convergence service layer.
- "src/application/service/inventory_move_engine.rs"
- "src/presentation/http/guarded_routes.rs"
# Own the hand-written inventory SQL that the valuation engine orchestrates: the Bin FOR UPDATE
# balance lock that serializes every stock move, the append-only SLE insert, the voucher headers +
# lines, and the masters. Declared here — not renamed with a `_custom` suffix — so the generator
# skips them wholesale; this declaration is what makes editing them legitimate.
- "src/infrastructure/persistence/bin_repository.rs"
- "src/infrastructure/persistence/stock_ledger_entry_repository.rs"
# The stock-convergence engine's own SQL: the quant FOR UPDATE row-lock (reservation apex,
# the authoritative reserved_quantity writer), the guarded move state-machine writes, and the
# move-line reservation mirror + the picking-state projection recompute (T1).
- "src/infrastructure/persistence/quant_repository.rs"
- "src/infrastructure/persistence/stock_move_repository.rs"
- "src/infrastructure/persistence/stock_move_line_repository.rs"
- "src/infrastructure/persistence/warehouse_repository.rs"
- "src/infrastructure/persistence/stock_item_repository.rs"
- "src/infrastructure/persistence/purchase_receipt_repository.rs"
- "src/infrastructure/persistence/purchase_receipt_item_repository.rs"
- "src/infrastructure/persistence/delivery_note_repository.rs"
- "src/infrastructure/persistence/delivery_note_item_repository.rs"
- "src/infrastructure/persistence/stock_entry_repository.rs"
- "src/infrastructure/persistence/stock_entry_item_repository.rs"
- "src/infrastructure/persistence/stock_reconciliation_repository.rs"
- "src/infrastructure/persistence/stock_reconciliation_item_repository.rs"
# Not schema-derived at all: the GL reconcile is uniform across all three voucher tables, so it
# has no entity of its own.
- "src/infrastructure/persistence/gl_voucher_repository.rs"
# Behavior tests (valuation golden oracle) + SLE integrity + GL seam + route probes + BDD.
- "tests/valuation_golden_cases.rs"
- "tests/move_engine_cases.rs"
- "tests/gl_posting_seam.rs"
- "tests/integrity_probes.rs"
- "tests/consumer_surface.rs"
- "tests/route_surface_guard.rs"
# Schema-to-DDL drift check — validates that every unique/index/constraint declared in
# schema YAML has a corresponding DDL counterpart in the migrated database.
- "tests/schema_drift_check.rs"
# Picking-as-projection (T1) + the quant-driven adjustment door probes.
- "tests/stock_projection_adjustment.rs"
- "tests/features/**"
# ENGINE BIND-ORDER rider probe test (RIDER 3).
- "tests/engine_bind_order.rs"
# Estate-divergence detector: after every voucher door fires, quant on-hand must move by
# the door qty, the Bin/quant/ledger estates must agree, and the legacy direct-SLE-write
# signature (voucher_type = the door's own voucher table) must stay gone.
- "tests/estate_divergence_detector.rs"
# Per-entity CRUD integration harness — frozen so hand cleanups persist across regen.
- "tests/integration_tests.rs"
- "tests/integration/**"
# Hand-authored module documentation.
- "docs/**"
# Hand-written cancellation service (stock move cancellation orchestration).
- "src/application/service/inventory_cancellation.rs"
# The picking-as-projection SQL (transfer/move minting, machine-gated move
# transitions, the T1 projection recompute) and the quant-driven adjustment SQL
# (count staging + apply flip). Companion repositories for the services in
# inventory_transfer.rs / inventory_reconciliation.rs; not schema-derived.
- "src/infrastructure/persistence/stock_picking_repository.rs"
- "src/infrastructure/persistence/stock_adjustment_repository.rs"
# Procurement configuration (stock.route / stock.rule / warehouse.orderpoint convergence):
# rule selection (_search_rule), pull/push move minting, the orderpoint computes, and the
# MovePipeline port the stock-move lifecycle implements for the daily scheduler.
- "src/application/service/procurement_service.rs"
# The SQL behind the procurement surface: rule search, orderpoint claims (FOR UPDATE SKIP
# LOCKED), the T11 forecast aggregation, move minting, quant housekeep.
- "src/infrastructure/persistence/procurement_repository.rs"
# The module's single scheduled job (the daily replenishment + reservation sweep).
- "src/infrastructure/jobs/**"
# R11 rule-company-consistency + R13-rule destination-not-a-view DB backstop (trigger);
# the service pre-check lives in procurement_service.rs, the declaration in
# schema/hooks/stock.hook.yaml.
- "migrations/20260826090000_rule_company_consistency.up.sql"
- "migrations/20260826090000_rule_company_consistency.down.sql"
# R1 warehouse-name-unique DB backstop (the name half of the per-company uniqueness;
# the code half ships with the base table migration). Declared in
# schema/models/warehouse.model.yaml; the generator does not rewrite the existing
# warehouse migration, so the index DDL is hand-owned here.
- "migrations/20260826100000_warehouse_name_unique.up.sql"
- "migrations/20260826100000_warehouse_name_unique.down.sql"
# The tenancy strip (ADR-0029): drops every module-native company-fence artifact
# (policies, company-leading indexes, the column) so org scoping installs purely
# via the composing decorator. Hand-authored; the generator cannot re-derive it.
- "migrations/20260913060000_strip_tenancy.up.sql"
- "migrations/20260913060000_strip_tenancy.down.sql"
# Targeted behavior tests for routes/rules/orderpoints + the scheduler sweep.
- "tests/procurement_scheduler_cases.rs"
# Hand-written migrations the generator cannot re-derive from the schema: child items
# company fence, FIFO valuation method drop, delivery recon currency, reversal columns,
# and status lifecycle state machine.
- "migrations/20260722000000_child_items_company_id_rls.up.sql"
- "migrations/20260722000000_child_items_company_id_rls.down.sql"
- "migrations/20260729000001_drop_fifo_valuation_method.up.sql"
- "migrations/20260729000001_drop_fifo_valuation_method.down.sql"
- "migrations/20260729000002_add_currency_to_delivery_recon.up.sql"
- "migrations/20260729000002_add_currency_to_delivery_recon.down.sql"
- "migrations/20260729000003_add_reversal_columns.up.sql"
- "migrations/20260729000003_add_reversal_columns.down.sql"
- "migrations/20260821130000_status_lifecycle.up.sql"
- "migrations/20260821130000_status_lifecycle.down.sql"
# Company RLS fence for the stock-convergence tables (quant/move/transfer/route/
# orderpoint/location/lot/package/operation-type). The generated enable_company_rls
# migration predates those tables and a regen does not rewrite it, so the fence DDL
# is hand-owned here.
- "migrations/20260821130024_company_fence_stock_convergence.up.sql"
- "migrations/20260821130024_company_fence_stock_convergence.down.sql"
# Reference data seeds: virtual location trees (loss/scrap, inventory adjustment,
# production input/output, transit) and the global MTO route + rule. These are
# shared_blank (company_id = NULL) and visible to every company.
- "migrations/seeds/reference_data_seed.sql"
- "migrations/seeds/seed_order.yml"
# Reversal-amount override on stock moves (forced_value): lets reverse moves carry
# the exact legacy amount when a voucher cancel re-drives valuation. Hand-written
# because the generator does not rewrite existing table migrations.
- "migrations/20260826140000_stock_move_forced_value.up.sql"
- "migrations/20260826140000_stock_move_forced_value.down.sql"
# Backorder policy vocabulary (always / delayed / never) on operation types:
# delayed defers reservation to the scheduler's claim sweep. Hand-written because
# the generator does not rewrite existing table migrations.
- "migrations/20260826140100_create_backorder_delayed.up.sql"
- "migrations/20260826140100_create_backorder_delayed.down.sql"
# Voucher -> minted-transfer seam: the `transfer_id` column + lookup index the schema
# declares on the four voucher tables. Hand-written because the generator does not
# rewrite existing table migrations; surfaced as drift by the schema-to-DDL check.
- "migrations/20260826140200_voucher_transfer_id_columns.up.sql"
- "migrations/20260826140200_voucher_transfer_id_columns.down.sql"
# GL settlement state on stock moves (the move's own AccountingPost outcome): column +
# sweep index, reusing the gl_posting_state enum. Hand-written because the generator does
# not rewrite existing table migrations; the schema declares the field + index on
# StockMove (schema/models/move.model.yaml).
- "migrations/20260826150000_stock_move_posting_state.up.sql"
- "migrations/20260826150000_stock_move_posting_state.down.sql"
# Move GL-leg re-drive probes: rejected post → failed → repost heals through the real
# accounting ledger; crash-window dedupe; door-owned and value-neutral legs stay
# not_applicable.
- "tests/move_gl_redrive.rs"
# Valuation-overlay columns the schema declares on existing tables: the per-unit shipping
# weight on the stock item master (the weight basis of landed-cost splits), the per-location
# valuation account override, and the is_landed_costs_line seam flag on receipt lines.
# Hand-written because the generator does not rewrite existing table migrations.
- "migrations/20260826150100_valuation_overlay_columns.up.sql"
- "migrations/20260826150100_valuation_overlay_columns.down.sql"
# Strict company fence (NOT NULL company_id + FORCE RLS, one tenant's rows only) for the
# valuation-overlay tables: inventory_company_settings + the landed-cost document family.
# The generated enable_company_rls migration predates these tables, so the fence DDL is
# hand-owned here, mirroring 20260821130024_company_fence_stock_convergence.
- "migrations/20260826150101_valuation_overlay_company_fence.up.sql"
- "migrations/20260826150101_valuation_overlay_company_fence.down.sql"
# Posting-posture probes: anglo-saxon delivery debit swap, periodic suppression, the
# valuation-account override chain, and the rollout no-op (absent settings row = today's
# shapes).
- "tests/valuation_posture_cases.rs"
# Landed-cost allocation probes: the three split bases, the loud zero-denominator
# rejection, HALF-UP + last-line-eats-the-diff rounding, the retroactive-revaluation
# asymmetry, the reversal pattern, and the single-writer guarantee.
- "tests/landed_cost_cases.rs"
# The valuation overlay's hand-owned SQL: the per-company posture read, the per-location
# valuation-account override, and the landed-cost document/worksheet writes. Not
# schema-derived; same reason gl_voucher_repository.rs is hand-owned.
- "src/infrastructure/persistence/valuation_overlay_repository.rs"
# The per-company posting posture the door posts and the move engine consult: the
# posture resolution helper, the anglo-saxon delivery-debit swap (fail-closed), the
# location valuation-account chain, and the explicit account-move gate.
- "src/application/service/inventory_posture.rs"
# Landed-cost document lifecycle: draft open, the three split bases with the loud
# zero-denominator rejection, the remaining-share revaluation via the engine's
# adjustment verb, the door-owned GL envelope, and the repost/cancel surfaces. The
# `_custom` suffix keeps it outside generator territory by naming convention; declared
# anyway so the hand-authored surface is explicit.
- "src/application/service/landed_cost_service_custom.rs"
# Extends the stock ledger's voucher_type vocabulary with 'landed_cost' — the producer
# label of the engine's landed-cost revaluation rows. Hand-written because the generator
# does not emit ALTER TYPE migrations; the down is a documented no-op (PostgreSQL cannot
# remove an enum member).
- "migrations/20260826150200_landed_cost_sle_voucher_type.up.sql"
- "migrations/20260826150200_landed_cost_sle_voucher_type.down.sql"
# Picking-batch membership (SB-1): the transfers.batch_id column + FK the schema declares
# on Transfer, the batch-member company-consistency trigger (the DB half of the fence),
# the strict fences for picking_batches/scraps, the scrap intra-module FKs, and the
# scrap positivity CHECK. Hand-written because the generator does not rewrite existing
# table migrations.
- "migrations/20260827140000_picking_batch_membership.up.sql"
- "migrations/20260827140000_picking_batch_membership.down.sql"
# Satellite master-data guards: package/storage/putaway positivity CHECKs (R15/16/17),
# the capacity target XOR, the intra-module FKs the generator does not emit across
# schema files, the T12 putaway storage-category derivation trigger, and the
# shared_blank fences for the five master-data tables.
- "migrations/20260827140100_satellite_master_guards.up.sql"
- "migrations/20260827140100_satellite_master_guards.down.sql"
# The picking-batch satellite's SQL: header mint, membership writes, the SB-1 stored-
# compute reproject, and the probe reads. Distinct from the generated
# picking_batch_repository.rs newtype (same reason gl_voucher_repository.rs is
# hand-owned).
- "src/infrastructure/persistence/picking_batch_projection_repository.rs"
# The scrap door's SQL: header mint, probe, the terminal done-stamp. Distinct from the
# generated scrap_repository.rs newtype.
- "src/infrastructure/persistence/scrap_door_repository.rs"
# The picking-batch satellite service: header mint, membership verbs, projection probes.
# The batch state is a stored compute over its member pickings — never written here.
- "src/application/service/inventory_batch.rs"
# The scrap satellite door: draft mint, process through the ONE move engine (a scrapped
# move to the loss sink), the deferred-GL form for the HTTP surface.
- "src/application/service/inventory_scrap.rs"
# SB-1 picking-batch cases: state derives from members (mixed bands, least-advanced),
# engine cascade, auto-cancel on empty, membership guards.
- "tests/picking_batch_cases.rs"
# Scrap-door cases (rides the engine once, GL exactly once, mint guards) + the satellite
# master-data guard family at the DB level (R7/R8/R9/R10, R15/16/17, XOR, T12).
- "tests/scrap_door_cases.rs"
# Router-level route-match probes: build the real guarded router and assert every
# parameterized route family (picking probe GET, batch-member add/remove, scrap GET +
# process, landed-cost validate/cancel) matches a real-UUID path with its real status —
# the behavior suites drive services and cannot see a route that never registers as a
# match. Plus a source-level guard against brace-style path segments (axum 0.7 treats
# them as literals).
- "tests/route_match_probes.rs"
# Armed-fence probes: drive the real engine/procurement/receipt surfaces as a
# restricted non-superuser role on a database whose row-level-security fence is
# ENABLE+FORCE (the composing service's posture). The behavior suites run as the
# migration owner, which bypasses RLS, so they cannot see the unbound-read
# defect class. Gated on INVENTORY_FENCE_DSN; skips with a printed reason when
# the fence DSN is absent.
- "tests/engine_fence_probes.rs"
# The service-delivery tracking policy on the product surface (the four-rung
# ladder + its two project anchors on stock_items). Hand-written because the
# generator does not rewrite existing table migrations.
- "migrations/20260829120000_service_tracking_columns.up.sql"
- "migrations/20260829120000_service_tracking_columns.down.sql"
# Service-tracking column probes: default-manual posture, per-rung round-trip
# through the entity mapping, and the enum's DB-level rejection of unknown rungs.
- "tests/service_tracking_probes.rs"
# Availability-scope probes: the all-variants sold-out verdict, display-vs-checkout
# scope freshness per call, the no-all-warehouses-fallback pivot refusal, and the
# no-materialized-readiness-state schema assertion.
- "tests/availability_scope_probes.rs"