Source responsibilities and verification map

main.rs contains process setup and the module registry. It delegates migrations and dependencies to bootstrap.rs and transports to routes.rs. HTTP, MCP and UCP invoke shared operations, rather than independently reimplementing checkout. Small modules use a crate-level shared type/import facade; SQL helpers remain internal. commerce/ and auth/ group their types, validation and operations. structure.py prevents Rust modules from exceeding 320 lines and keeps main.rs under 120. Every Rust source starts with a responsibility comment.

The table lists executable behavioral coverage, not percentage line coverage. Pure rules use Rust tests; API/domain/storage modules are exercised against real PostgreSQL, Qdrant and (where enabled) the real local model. Tests include rejected inputs and state effects. A module's presence does not count as a test.

The maintained full inventory, including all newly added Rust files, frontend feature folders, independent services and SDKs, is module-inventory.md. Coverage percentages and explicit remaining gaps are in testing.md. The tables below describe selected behavioral suites and must not be read as 100% coverage.

Production foundations

The illustrated architecture guide connects ingress, tenant scope, stock/money/payment transactions, outbox projections, AI and deployment. New boundaries live in money.rs, tenant_scope.rs, performance/{row_security, admission,invalidation}.rs, commerce/inventory.rs, payments/state.rs, platform/quotas.rs and migrations/schema.rs. Unit tests, the strict production_foundations suite, payment fixtures and original-Shopware money boundary comparison cover their effects; asynchronous SQL and provider code remain unproved.

International configuration and language boundaries

commerce/geography.rs owns catalogue/overlay/address admission; tax_rules.rs owns guarded destination selection and tax_context.rs its private Rule Builder facts. settings_defaults.rs, method_text.rs, content_text.rs and product_languages.rs own compatibility defaults, translations and language registration. international_capabilities.rs shares native HTTP operations with MCP. translations/{routes,worker,fields,apply}.rs own durable translation lifecycle, text-only inference and locked revision-checked apply. The real PostgreSQL suites international_commerce.py and translations.py plus catalog tests cover these paths. frontend/src/shared/geography owns controls reused in Studio and checkout. See international commerce for the exact contract.

Rust behavioral test map

New v0.5 modules

Frontend

Browser interactions were checked with the actual local app. They are not a committed automated browser regression suite. Accessibility, assistive-device coverage, all mobile breakpoints and exhaustive visual diffs remain additional work; do not infer those from screenshots or typechecking.

App frontend modules: AppsManager/AppEntity manage lifecycle/data; AppFrame provides the constrained iframe SDK bridge; AppSlot personalizes products; PaymentSession/PaymentManager display customer/provider state; admin/intelligence/KnowledgeView and MemoryRecommendations connect evidence to approved suggestions. app-i18n supplies four-language host vocabulary; apps.css scopes their layout. Verification: strict build plus actual browser navigation/data/configuration, backed by apps.py, services.py, payments.py and providers.py. No automated visual/iframe-browser regression suite is claimed.

Persistence, fixtures and tooling

Migrations 001–005 retain the earlier core/graph/context model. 006 adds SKU metadata, review storage and commerce settings; 007 initializes synthetic demo commerce once; 008 adds personal users/memberships/invitations/sessions; 009 corrects template variant capacity and the authored example review. Migrations are additive; existing stock/orders/prices are retained. Migration 010 adds managed app metadata/DDL, event deliveries, knowledge evidence and payment attempts/jobs/inbox/reservations; core monetary quotes retain their original shape. No production Shopware store is imported by these migrations.

fixtures/demo-catalog.json and demo-settings.json are fixed public templates for new workspaces, not exports of current merchant state. frontend/public/media contains 33 authored SVG illustrations. Four executable WAT policies and their limitations are documented in extensions/README.md.

The original Shopware reference lives in reference/ (Composer-pinned source and independent PHP runners). porting/units.json and scripts/port.py select incremental migration gates. scripts/dev.sh starts the isolated local demo; mcp_stdio.py bridges explicit client credentials. CI builds/types/lints/tests, executes original PHP comparisons and the real DB suites. Private state, credentials and DB backups remain ignored in .run, .env and local work.

See shopware-parity.md for exact equivalence boundaries and security.md for production gaps. No 100% code-coverage or full Shopware compatibility claim is made.

| src/checkout_handoff.rs | Generic expiring, single-use transfer of an authoritative cart; rotates tokens. | checkout_handoff.py real PostgreSQL concurrency/order checks | | extensions/apps/storyfront/manifest.json | Storyfront app capabilities, separate service and merchant UI contract. | Installed package + actual connector/browser flow; see storyfront.md |

Workbench and additional commerce domains

Migrations 011, 013–015 add source documents/chunks, environment/release/build records, customer sessions/profiles, rules/promotions/flows/channels/product metadata and anonymous behavior signals. Migration 012 contains checkout handoff. The domain file guard remains enforced: Rust modules at most 320 lines, main.rs at most 120 lines, each module starts with its responsibility comment.

Bounded reads and setup

scalability.py also checks a 120-variant family, last-page reviews, deep links, 64 cart edits with 32 clients and competing optimistic revisions. Independent processes were restarted against the million-product database, with warm database caches; this is not a machine/database cold-start or failover test.

Customer/merchant operations addition

The file guard verifies every Rust module's responsibility header and maximum 320 lines (main.rs maximum 120). Tests cover the listed actual behaviors; this does not claim every source line or every original Shopware operation is covered.

Formal policy extraction

All 353 Rust modules have explicit status and review inventory in proof/manifest.json. The 34 consumer modules are reviewed bindings, not whole-module proofs. See the exact formal coverage and remaining gaps.

Connected provider apps and automation

The upstream condition-by-condition status is recorded in reference/rule-catalog.json.

Platform control plane

Frontend: PlatformConsole coordinates state; PlatformSignIn owns personal login; PlatformLanguage selects locales; PlatformDashboard renders factual metrics; PlatformShops owns directory/provisioning views; platform-api is the typed transport and platform-i18n contains complete operator UI translations. The production-mode Docker smoke test checks the packaged server and frontend.

Full-app surfaces and execution admission

Every host location and limit is listed in the full app contract. External app code, service declarations and frontend behavior remain outside the partial Lean proofs. No new core database migration was required for these optional manifest fields and generated app tables.

Source rule and durable flow migration

See automation for the precise supported/disabled catalog and action mappings.

Reproducible local playground

The merchant walkthrough is playground.md. Its sample flow uses no model or external delivery provider. The exact current source inventory is generated separately.

Integrated catalog and category management (2026-10-05)

Original Shopware mapping, supported features and remaining gaps.

Company identity, per-channel inheritance, logos and legal storefront/issuer consumers: company settings module map. Real integration suite: scripts/company_settings.py; UI regressions: frontend/tests/unit/company-settings.test.tsx.

Scoped checkout settings, method dependency guards, selective staging and product media jobs: module map and verification.

Knowledge sources, product graph evidence, observed decisions and retrieval preview: domain ownership and verification. Real suites: knowledge_workspace.py, developer_documents.py, apps.py, connected_apps.py; component regressions: knowledge-workspace.test.tsx.

Managed storage/search integration: managed_search.py verifies ordinary PostgreSQL, real Qdrant, hostname scope, durable deletion/retry and lexical fallback with synthetic embeddings. It does not measure AI quality.

Connected CRM and entity history

history/{mod,routes,capability,restore,product}.rs owns trusted attribution, scoped paging, MCP parity and restoration through domain handlers. Migrations 034/035 capture transaction-coalesced aggregate snapshots. accounts/address_restore.rs owns validated address-book restoration; commerce/{customer_groups,group_usage}.rs owns group definitions, price basis and dependency admission. shared/history/ is reused by native editors and admin/shell/useEntityNavigation.ts owns scoped entity/back paths. scripts/crm_history.py and frontend/tests/unit/crm-history.test.tsx cover these paths, alongside existing customer, merchant, automation and staging suites. See history boundaries.

Guided app extension path

App assistants compile the shared Manifest in frontend/src/admin/developer/assistant-model.ts. Product/customer/order mounts reuse the native renderer with explicit object context. src/apps/editor_contract.rs owns field/context and direct-route scopes; src/apps/planning.rs filters merchant grounding and rechecks app proposal access at bind/apply. src/apps/schedules.rs and webhooks.rs persist emitted events/receipts via migration 036. scripts/app_assistants.py and app_surfaces.py exercise actual private stages, public/MCP boundaries, service fixtures, event/Flow writes, restart and scope rejection; frontend assistant tests cover editing and regional language inheritance. See guide and upstream extension requirements.

Platform control plane

Default fashion fixture

src/demo_catalog.rs copies the public Nord Atelier fixture into newly provisioned tenants and seeds an opt-in built-in demo once. src/auth/provision.rs controls whether catalog insertion is requested. src/knowledge/relations.rs chooses catalog-specific curated links. scripts/fashion_demo.py checks signup, localized names/navigation, actual images, all three coat sizes, tenant-separated stock, simulated checkout and a fresh-process restart. See the complete demo contract.

Trusted private experience boundary

src/auth/{broker,broker_inference,handoff}.rs owns route-bound signatures, one-use personal login and inherited inference. src/shop_domains/frontends.rs owns guarded public mounts and credential-stripping proxying. src/commerce/product_create.rs accepts stable import IDs through the normal product save pipeline. scripts/identity_broker.py covers actual HTTP/PostgreSQL ownership, replay, scope, paused-shop and restart behavior. See configuration and trust boundaries.

• src/storefront_pages.rs: direct product URL HTML admission using existing tenant/channel policy.
• frontend/src/storefront/catalog/product-url.ts: localized product URLs, legacy SKU routes and collection navigation.

European operation

src/legal/ owns privacy policy/receipt, guarded checkout snapshots, sector facts and consumer request review. frontend/src/{admin,shared,storefront}/legal/ connects their actual interface and consent consumers. Migration 048 scopes receipts, logs and review audits; the email connector and Flow Builder consume their outbox events. See the complete behavior map and limits.

Hosted frontend transport

src/shop_domains/frontend_transport.rs streams the fixed, authenticated external frontend response with backpressure and an 8 MB cumulative body limit. SSE starts before upstream EOF; a body failure closes the stream. HOSTED_FRONTEND_COOKIE_NAMES defaults empty and optionally permits at most eight opaque anonymous shopper cookies. Login credentials remain stripped. Cookies returned to the browser must be host-only, Secure, HttpOnly and SameSite=Lax; redirects must be relative. This generic adapter contains no private Storyfront implementation. identity_broker exercises routing, foreign-shop denial, cookie filtering, paused shops and streaming through the real HTTP service. The network adapter remains outside the Lean proof boundary.

src/auth/broker_credentials.rs owns explicit trusted-email password enrollment/recovery and existing-password verification. Migration 052 marks new broker accounts pending; sessions.rs reports that state and handoff.rs enforces enrollment before Studio entry. scripts/identity_broker.py checks real login, ownership, replay and revocation. See merchant password enrollment.

Channel access and frontend bindings

marketing/channel_access.rs is the shared Store API/UCP/MCP/hosted admission boundary; channel_preview.rs owns personal, one-use browser previews. auth/middleware.rs strips forged preview principals and adds the validated request marker consumed by catalog, cart, navigation and legal paths. shop_domains/frontend_bindings.rs owns revisioned tenant/Experience alias CRUD; it reuses hosted_frontends, not another domain registry. The private renderer remains in the private integration repository. See channel management for behavior and limits.

HTTP failure diagnostics

src/channel_metrics.rs owns the bounded interval buffer and single bulk flush; src/channel_metrics/reads.rs shares exact status aggregation across operator overview, shop dossiers and infrastructure. src/studio.rs supplies status and sanitized route-template logs after authentication admission. Migration 056 preserves historical totals and adds only a bounded status-code histogram. frontend/src/platform/HTTPResponses.tsx presents access refusals, other 4xx, 5xx and unclassified history with the shared translated vocabulary. channel_metrics unit tests, scripts/platform_control.py and http-responses.test.tsx cover classification, real persistence, tenant-scoped reads, historical preservation and display. See the measurement boundary.

Core hardening owners

• src/request_context.rs, src/auth/{route_policy,identity,abuse,dto}.rs and identity.sql: trusted Principal, explicit method rights, one current grant lookup, persistent login admission and typed auth requests.
• src/scoped_pool.rs, src/performance/{pool,row_security,cluster_lease}.rs, src/runtime_config.rs: local transaction scope, guarded session borrows, validated startup contracts and shared resource/connection budgets.
• src/sandbox_cache.rs, src/apps/runtime.rs, src/assets/image_provider.rs: bounded Wasm compilation/execution cache and blocking-pool image processing.
• src/work_signal.rs, src/outbox.rs, src/outbox/{control,retention}.rs, retention.sql and migration 057: commit hints, isolated retries/quarantine, permission-checked recovery and bounded retention.
• deploy/sql/provision-runtime.sh, scripts/security/core_hardening.py, scripts/testing/pooler.py, scripts/transaction_pooler.py: least-privilege provisioning and actual two-replica/one-backend PgBouncer regression paths.

All eighteen findings, shared architecture and exact limits.

Request-hotpath consolidation (2026-10-08)

Raw measurements and exact limits; SQL/async adapters remain unproved despite explicit source-review locks.

App-platform ownership

The connected extension contract and file-level ownership are maintained in App platform, App Studio and App security. The generated module inventory lists every actual Rust/frontend/example source, including modules without measured coverage. Rich descriptions now share frontend/src/shared/content/editor/; do not create a separate app editor or catalog-only implementation.

Connected cognition foundation

The cognitive commerce guide maps migrations 071–078, bounded retrieval/model protocols, original registry read tools, native guardrail apply, evidence/signatures, controlled layout trials and private cart preferences. Its audit tracker identifies still-unimplemented recommendations. The generated module inventory includes every new source; no complete-core proof or 100% behavioral coverage is implied.

Forced-RLS lexical candidates

migrations/079-knowledge-lexical-indexes.sql owns transactional word projection backfill/triggers and composite source containment. src/knowledge/search.sql and src/documents/search.sql narrow candidates, then hydrate/rank/admit current native records. src/documents/retrieval.rs remains the public/private retrieval adapter. scripts/lexical_search.py, registered in the existing integration suite registry, checks real non-owner plans, native edits, withdrawal, source deletion and foreign-context rejection. These are rebuildable indexes, not another source registry. See the performance and migration boundary.

• src/apps/ontology.rs: validated namespaced app-node/edge metadata and bounded projections of current authorized native records; no second graph fact store.
• frontend/src/admin/developer/AppOntology.tsx: shared-language mapping controls over the exact human/agent app manifest.
• scripts/app_ontology.py: real API/MCP tenant, permission, reference and revision regression.

Checkout continuity source owners