How closed definitions acquire operational authority, and how historical records move without replay.
Applications publish validated registrations containing an immutable execution definition and an independently versioned presentation. Provider and Domain libraries expand into ordinary closed Template/Expression data. The executor installs no provider handlers or native expression callbacks.
Operational bindings contain public endpoint names, credential/key references, explicit origin and placement policies, and approved execution digests. Credentials and private keys come from external secret storage, not authoring metadata. Presentation-only edits do not change execution authority.
Main-app policy: repository templates compiled into the main app may use the deployment's
configured capabilities; effect provisioning is computed from those compiled templates at startup.
There is no runtime authoring path (the template editor is a read-only viewer and templates:write
is retired). Trusted deploy-time extras supplied with PROCESS_EXTRA_TEMPLATES are published like
repository templates but receive no additional effect approvals. Authority must come from the trusted registration/service
boundary and deployment policy, not arbitrary program or presentation claims. The generic standalone
backend remains operator-explicit and deny-by-default; sharing a template key alone grants nothing.
PROCESS_APP_CONFIG supplies application authoring bindings and generic effect provisioning. The
standalone backend uses PROCESS_BACKEND_CONFIG with compiled registrations, document assets and
effect provisioning; it has no built-in application registry. Public endpoint bindings must not contain
raw credentials. Known default RPC path credentials are removed before a public endpoint is recorded;
other authenticated endpoint shapes require explicit public URL and protected insertion configuration.
Signing and captured/derived credentials require an external encryption keyring and a separate handle-
derivation key. Default Safe or Sheets signing provisioning requires PROCESS_EFFECT_ENCRYPTION_KEY and
PROCESS_EFFECT_DERIVATION_KEY, each a 32-byte base64 value. Do not commit these values. File-backed
processes need the encrypted repository on durable shared storage; Mongo deployments use the Mongo
encrypted-envelope repository. Static-credential-only calls do not create encrypted handles.
Application/worker initialization is lazy: importing routes during a build does not connect to or seed
storage. Requests and explicit workers await initialization. Each compiled template whose execution or
presentation digest differs from the stored latest is published (one [templates] published <key> log
line per key); identical digests are a no-op, and running processes stay bound to their pinned execution. Starting a polling worker is a separate entrypoint, not an API-server side effect.
Known definitive failures retain their prior policy where applicable: the authoring compiler expresses retry/backoff using ordinary recovery, clock and wait composition. An uncertain driver exception does not enter that recovery path. Host-dependent datetime parsing is an explicit recorded effect; pure UTC operations do not silently consult the deployment timezone.
Do not start old and new writers against a cutover dataset simultaneously. Obtain an authorized, consistent export and preserve its original evidence and attachment bytes before conversion.
Run migrate:language with an input export, explicit public target bindings, and a new output directory.
The default is a dry-run plan. --apply-to explicitly enables a create-only import into a separate file
store. The compiler does not infer production capability availability from an offline machine's secrets.
The plan records the public bindings fingerprint; verify it and the execution approvals against the
intended deployment before activating a worker.
Historical definitions are retained without becoming current templates. Only explicit latest-template exports become latest pointers. Existing destination records/versions must match exactly or import stops; nothing is silently overwritten. Human visits and recorded waits resume without replaying prior actions. Uncertain automated states are held for operator reconciliation. Unsupported source, conflicting ids, ambiguous timestamps and oversize records are reported, not guessed or truncated.
The migration planner preserves attachment references, not attachment bytes. Copy/verify the separately stored files and compare public record/export views before cutover. Real data sizing, live Auth0/provider configuration, hosting settings and deployment approval remain rollout gates; synthetic tests do not establish them.
The new state/claim protocol does not claim transparent recovery through every crash or provider failure. Orphaned claims, protocol-specific reconciliation, token renewal across long pauses, automatic idempotent retries and external side-effect compensation remain explicit follow-up work. Never infer exactly-once external execution from a successful local CAS or from a passing synthetic test.