{ "version": 1, "scope": "C# typed common flag seams and their property reads; dynamic configuration and external workers still require manual audit", "consumers": { "src/libs/kernel/SyRF.SharedKernel/Settings/FeatureFlags.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "public class FeatureFlags" ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/SharedRuntimeFeatureFlagReader.cs": { "classification": "shared-reader", "owner": "Shared platform maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Immutable capture; API membership admission only when explicitly selected; PM shadow evaluation", "reads": [ "public sealed class SharedRuntimeFeatureFlagReader(IRuntimeFeatureFlagDocumentReader source, TimeProvider timeProvider) : IDisposable" ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/SharedRuntimeFeatureFlagRegistration.cs": { "classification": "shared-reader", "owner": "Shared platform maintainers", "scope": "shared reader used by API and Project Management", "activationBoundary": "Production rejects enabled modes; API membership and PM statistics serving require explicit non-production modes and current observations; against initialized authority the reader serves deployed defaults only (6C.5, D7=A)", "reads": [ "configuration.GetValue(\"FeatureFlags:DisableMembership\"),", "configuration.GetValue(\"FeatureFlags:MaterializedProjectStatisticsServing\"));", "services.AddSingleton();", "public sealed class SharedRuntimeFeatureFlagRefreshService(SharedRuntimeFeatureFlagReader reader) : BackgroundService", "await reader.RefreshAsync(cancellationToken);", "while (await timer.WaitForNextTickAsync(stoppingToken)) await reader.RefreshAsync(stoppingToken);", "SharedRuntimeFeatureFlagReader reader, SharedRuntimeFeatureFlagOptions options) : IHealthCheck", "var observed = reader.Capture();", "[\"evaluatedValue\"] = options.Enabled && reader.Evaluate(consumerKey, deployedDefault) is { } evaluated", "if (options.Enabled && observed.State == SharedRuntimeFeatureFlagReader.AuthorityPreservedState)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Control/ProjectStatisticsModeAdministrationService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "var activeReviewerMode = _flags.ActiveReviewerTrackingAvailable;", "&& _flags.IsProjectAllowlisted(projectId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/ProjectAnnotationStatisticsWriter.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "_flags.MaterializedWritesRequested", "&& WriteFamilies.Any(_flags.IsFamilyServingRequested)", "&& _flags.IsProjectAllowlisted(projectId);", ".Where(_flags.IsFamilyServingRequested)", "var movesQuestionAnswers = _flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.QuestionAnswers);", "&& globalControl.ActiveReviewerTrackingAvailable != _flags.ActiveReviewerTrackingAvailable;", "if (!_flags.IsFamilyServingRequested(family)", "operation.DurableTrackingMode ?? _flags.ActiveReviewerTrackingAvailable);" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/StageAnnotationAuthoritativeQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags)", "&& global.ActiveReviewerTrackingAvailable != _flags.ActiveReviewerTrackingAvailable)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/AnnotationStageBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Delegates to the existing statistics backfill publication guard; preserve the project's domain-bound flag lifecycle until that operation is audited for shared runtime enrollment", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/DomainReconciliationBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Domain reconciliation inherits the existing annotation backfill publication guard; preserve domain-bound flags until the operation is audited for shared runtime enrollment", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/MembershipStageAnnotationBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Membership-stage backfill inherits the existing statistics publication guard; retain startup/domain-bound flags until the backfill and rebuild contract is audited for runtime changes", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/ReviewerAnnotationBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Reviewer annotation backfill inherits the existing statistics publication guard; retain startup/domain-bound flags until the backfill and rebuild contract is audited for runtime changes", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/StageAnnotationBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/StageAnnotationStatisticsQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "if (!_flags.PagesConsumerEnabled)", "if (!_flags.StageOverviewConsumerEnabled)", "if (!_flags.MaterializedWritesRequested)", "if (!_flags.MaterializedServingRequested)", "if (!_flags.IsFamilyServingRequested(AnnotationStatisticsClassifier.StageFamily))", "if (!_flags.IsProjectAllowlisted(projectId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/QuestionAnswers/QuestionAnswersAuthoritativeQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Guarded live question tally refuses when the global active-reviewer tracking capability disagrees with this host's flag; preserve current lifecycle/domain contract", "reads": [ "IProjectStatisticsGlobalControlRepository globals, IProjectStatisticsFlagSource flags)", "if (global is not null && global.ActiveReviewerTrackingAvailable != flags.ActiveReviewerTrackingAvailable)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/QuestionAnswers/QuestionCountsQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Question-designer count consumer (FEAT-024), default off; the API runtime provider mirrors materializedProjectStatisticsQuestionCounts into FeatureFlags, and the projection path also requires pages consumers, writes, serving, the question family and the project allowlist. Disabled or refused responses keep existing questions locked or legacy editing; never unlock on missing evidence", "reads": [ "IQuestionAnswersAuthoritativeQuery authoritative, IProjectStatisticsFlagSource flags,", "FeatureFlags consumerFlags, ILogger logger) : IQuestionCountsQuery", "public bool IsEnabled(Guid projectId) => consumerFlags.MaterializedProjectStatisticsQuestionCounts", "&& flags.PagesConsumerEnabled && flags.MaterializedWritesRequested && flags.MaterializedServingRequested", "&& flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.QuestionAnswers) && flags.IsProjectAllowlisted(projectId);", "ProjectStatisticsConsumerReadObservation.GateReason(consumerFlags.MaterializedProjectStatisticsQuestionCounts," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/QuestionAnswers/QuestionAnswersBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Question-answer backfill inherits the existing bounded publication guard; retain startup/domain-bound flags until its rebuild and scope-set verification contract is audited for runtime changes", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/QuestionAnswers/ProjectStatisticsDefinitionRewriteFence.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags)", "(_flags.MaterializedWritesRequested || _flags.MaterializedServingRequested)", "&& _flags.IsProjectAllowlisted(projectId);" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Screening/MembershipScreeningBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Screening/ProjectScreeningBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "if (!_flags.IsProjectAllowlisted(projectId))", "if (!_flags.MaterializedWritesRequested)", "if (!_flags.IsFamilyServingRequested(_calculator.MetricFamily))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Screening/ProjectScreeningAdministrativeStatisticsQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags,", "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Screening/ProjectScreeningStatisticsQueryAdapter.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "if (!_flags.MaterializedWritesRequested)", "if (!_flags.MaterializedServingRequested)", "if (!_flags.IsFamilyServingRequested(ProjectScreeningClassifier.Family))", "if (!_flags.IsProjectAllowlisted(projectId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Screening/ProjectScreeningStatisticsWriter.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "_flags.MaterializedWritesRequested", "&& (_flags.IsFamilyServingRequested(ProjectScreeningClassifier.Family)", "|| _flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.MembershipScreening)", "|| _flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ReviewerScreening))", "&& _flags.IsProjectAllowlisted(projectId);", "ReviewerFamilies.Any(_flags.IsFamilyServingRequested) && _reviewerSnapshots is not null", "var reviewerFamilies = ReviewerFamilies.Where(_flags.IsFamilyServingRequested).ToArray();", "var moves = _flags.IsFamilyServingRequested(ProjectScreeningClassifier.Family)", "&& !_flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.MembershipScreening)", "&& !_flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ReviewerScreening))", "if (!_flags.IsFamilyServingRequested(ProjectScreeningClassifier.Family) && projectMoves.Count > 0)", "foreach (var family in ReviewerFamilies.Where(_flags.IsFamilyServingRequested)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Screening/ReviewerScreeningBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/IProjectStatisticsFlagSource.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "public interface IProjectStatisticsFlagSource" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsDailyObservationRunner.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Per-delivery check before daily admission; the PM consumer is additionally gated by the default-off ProjectStatisticsDailyObservations:Enabled option and the durable fleet/project gates; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags,", "if (!flags.MaterializedWritesRequested)", "if (global.ActiveReviewerTrackingAvailable != flags.ActiveReviewerTrackingAvailable)", ".Where(family => family != ProjectStatisticsMetricFamily.DerivedSummary && flags.IsFamilyServingRequested(family))", "if (family == ProjectStatisticsMetricFamily.DerivedSummary || !flags.IsFamilyServingRequested(family)) continue;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsSourceVisibilityFenceService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit; #4288: the writes/serving flags and the project allowlist gate fence admission only (off, a raise writes nothing). A completion evaluates them once at entry; off, one read of the control outside any transaction decides, and only this job's own token is cleared (families left Stale, never rebuilt); holding none, or another job's, it writes nothing and never faults the legacy job", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags)", "(_flags.MaterializedWritesRequested || _flags.MaterializedServingRequested)", "&& _flags.IsProjectAllowlisted(projectId);", "if (!requested || !_flags.MaterializedWritesRequested || _rebuilds is null)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/ProjectStatisticsRegistry.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "For().Use(new StaticProjectStatisticsFlagSource()).Singleton();" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Read/ProjectStatisticsAdministrativeBundleReader.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Read/ProjectStatisticsAdministrativeFamilyReads.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags,", "FeatureFlags consumerFlags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Read/ProjectStatisticsAuditBundleReader.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags,", "internal sealed class ProjectStatisticsAuditFlagSource : IProjectStatisticsFlagSource", "private readonly IProjectStatisticsFlagSource _inner;", "public ProjectStatisticsAuditFlagSource(IProjectStatisticsFlagSource inner) =>", "public bool MaterializedWritesRequested => _inner.MaterializedWritesRequested;", "_inner.MaterializedWritesRequested && _inner.IsFamilyServingRequested(metricFamily);", "public bool PagesConsumerEnabled => _inner.PagesConsumerEnabled;", "public bool StageOverviewConsumerEnabled => _inner.StageOverviewConsumerEnabled;", "public bool SignalRConsumerEnabled => _inner.SignalRConsumerEnabled;", "public bool ActiveReviewerTrackingAvailable => _inner.ActiveReviewerTrackingAvailable;", "public bool IsProjectAllowlisted(Guid projectId) => _inner.IsProjectAllowlisted(projectId);" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Read/ProjectStatisticsBundleReader.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "&& globalControl.ActiveReviewerTrackingAvailable != _flags.ActiveReviewerTrackingAvailable)", "&& globalControl.ActiveReviewerTrackingAvailable != _flags.ActiveReviewerTrackingAvailable)", "if (!_flags.MaterializedServingRequested) return ProjectStatisticsFallbackReason.Disabled;", "if (!_flags.IsProjectAllowlisted(projectId)) return ProjectStatisticsFallbackReason.Disabled;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Read/ProjectStatisticsConsumerReadObservation.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags,", "if (!consumerEnabled || !flags.PagesConsumerEnabled) return ProjectStatisticsConsumerFallbackReason.ConsumerDisabled;", "if (!flags.MaterializedWritesRequested) return ProjectStatisticsConsumerFallbackReason.WritesDisabled;", "if (!flags.MaterializedServingRequested) return ProjectStatisticsConsumerFallbackReason.ServingDisabled;", "var allowlisted = flags.IsProjectAllowlisted(projectId);", "var familiesOn = families.All(flags.IsFamilyServingRequested);" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/StaticProjectStatisticsFlagSource.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "public sealed class StaticProjectStatisticsFlagSource : IProjectStatisticsFlagSource" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Wiring/FeatureFlagsProjectStatisticsFlagSource.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "public sealed class FeatureFlagsProjectStatisticsFlagSource : IProjectStatisticsFlagSource", "private readonly FeatureFlags _featureFlags;", "FeatureFlags featureFlags, ProjectStatisticsAllowlist? allowlist = null)", "_featureFlags = featureFlags ?? throw new ArgumentNullException(nameof(featureFlags));", "public bool MaterializedWritesRequested => _featureFlags.MaterializedProjectStatisticsWrites;", "_featureFlags.MaterializedProjectStatisticsServing,", "_featureFlags.MaterializedProjectStatisticsWrites);", "public bool PagesConsumerEnabled => _featureFlags.MaterializedProjectStatisticsPages;", "_featureFlags.MaterializedProjectStatisticsStageOverview;", "public bool SignalRConsumerEnabled => _featureFlags.MaterializedProjectStatisticsSignalR;", "public bool ActiveReviewerTrackingAvailable => _featureFlags.ActiveReviewerTrackingAvailable;", "ProjectStatisticsFlagMap.IsFamilyServingRequested(metricFamily, _featureFlags);", "public bool ReviewerProgressConsumerEnabled => _featureFlags.MaterializedProjectStatisticsReviewerProgress;", "public bool StageOverviewBundleConsumerEnabled => _featureFlags.MaterializedProjectStatisticsStageOverviewBundle;", "public bool ScreeningInfoConsumerEnabled => _featureFlags.MaterializedProjectStatisticsScreeningInfo;", "public bool ProjectReviewerProgressConsumerEnabled => _featureFlags.MaterializedProjectStatisticsProjectReviewerProgress;", "public bool MaterializedFoldRequested => _featureFlags.MaterializedProjectStatisticsFold;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Wiring/ProjectStatisticsFlagMap.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "ProjectStatisticsMetricFamily metricFamily, FeatureFlags featureFlags) =>", "ScreeningKey => featureFlags.MaterializedProjectStatisticsScreening,", "MembershipScreeningKey => featureFlags.MaterializedProjectStatisticsMembershipScreening,", "AnnotationKey => featureFlags.MaterializedProjectStatisticsAnnotation,", "MembershipAnnotationKey => featureFlags.MaterializedProjectStatisticsMembershipAnnotation,", "QuestionAnswersKey => featureFlags.MaterializedProjectStatisticsQuestionAnswers,", "SearchPopulationKey => featureFlags.MaterializedProjectStatisticsSearchPopulation,", "DerivedSummariesKey => featureFlags.MaterializedProjectStatisticsDerivedSummaries,", "IProjectStatisticsFlagSource flags)", "new(WritesKey, flags.MaterializedWritesRequested),", "flags.MaterializedServingRequested, flags.MaterializedWritesRequested)),", "flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ProjectScreening)),", "flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.MembershipScreening)),", "flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.StageAnnotation)),", "flags.IsFamilyServingRequested(", "flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.QuestionAnswers)),", "flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.SearchPopulation)),", "flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.DerivedSummary)),", "new(PagesKey, flags.PagesConsumerEnabled),", "new(StageOverviewKey, flags.StageOverviewConsumerEnabled),", "new(SignalRKey, flags.SignalRConsumerEnabled),", "new(ReviewerProgressKey, flags.ReviewerProgressConsumerEnabled),", "new(StageOverviewBundleKey, flags.StageOverviewBundleConsumerEnabled),", "new(ScreeningInfoKey, flags.ScreeningInfoConsumerEnabled),", "new(ProjectReviewerProgressKey, flags.ProjectReviewerProgressConsumerEnabled),", "new(FoldKey, flags.MaterializedFoldRequested)," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Write/ProjectStatisticsStagedOperationFenceService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags)", "(_flags.MaterializedWritesRequested || _flags.MaterializedServingRequested)", "&& _flags.IsProjectAllowlisted(projectId);" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/StageReviewService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly FeatureFlags _featureFlags;", "FeatureFlags featureFlags,", "_featureFlags = featureFlags;", "if (_featureFlags.ReviewEligibilityPolicy)", "? _featureFlags.ActiveReviewerTrackingAvailable", "_featureFlags.MaterializedProjectStatisticsWrites", ": Task.FromResult(_featureFlags.ActiveReviewerTrackingAvailable);", "if (_featureFlags.MaterializedProjectStatisticsFold)", "var result = await ReservationChangeSave.TrySaveAsync(_unitOfWork, _featureFlags, study, stageId,", "if (existing is null || !_featureFlags.ReviewEligibilityPolicy)", "if (_featureFlags.MaterializedProjectStatisticsWrites)", "else if (!_featureFlags.ActiveReviewerTrackingAvailable)", "if (!_featureFlags.ReviewEligibilityPolicy && AlreadyOwnsSlot(current, projectId, stage, reviewerId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Telemetry/ProjectStatisticsDarkStateStartupLog.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/DelegatedWorkRegistry.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "Application-authority M5a: deployment-only DelegatedWorkAdmissionEnforced selects the delegated-job gate; off keeps every job consumer on its legacy path with no reads; not runtime-overridable; #4290: deployment-only applicationSuspension (rendered into project-management from the API's Helm value) decides whether the gate's subject reader enforces a stored suspension; off, a suspended actor is not refused for it", "reads": [ ".Use(context => new DelegatedWorkGateSettings(context.GetInstance().DelegatedWorkAdmissionEnforced))", "context.GetInstance().ApplicationSuspension))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/ProjectStatisticsFamilyCalculatorRegistry.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "context.GetInstance()," ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/ProjectStatisticsProductionRegistry.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "For().Use().Singleton();" ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/ProjectStatisticsSourceFenceRegistry.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "context.GetInstance())", "context.GetInstance())" ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/Repositories/ProjectStatistics/ProjectScreeningAuthoritativeQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "MongoContext context, IProjectStatisticsSnapshotFactory snapshots, FeatureFlags flags)", "if (global is not null && global.ActiveReviewerTrackingAvailable != flags.ActiveReviewerTrackingAvailable)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/Repositories/ProjectStatistics/SearchPopulationBackfillService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/Repositories/StudyRepository.AllocationReads.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "var tracking = _featureFlags.ActiveReviewerTrackingAvailable;", "stage.SessionCountTarget, project.AgreementThreshold, _featureFlags.ActiveReviewerTrackingAvailable)", "if (_featureFlags.ActiveReviewerTrackingAvailable)", "var tracking = _featureFlags.ActiveReviewerTrackingAvailable;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/Repositories/StudyRepository.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly FeatureFlags _featureFlags;", "FeatureFlags? featureFlags = null,", "_featureFlags = featureFlags ?? new FeatureFlags { ActiveReviewerTrackingEnabled = true };", "session: null, _featureFlags.MaterializedProjectStatisticsWrites);", "var processFlagValue = _featureFlags.ActiveReviewerTrackingAvailable;", "var writesEnabled = _featureFlags.MaterializedProjectStatisticsWrites;", "_featureFlags.ActiveReviewerTrackingAvailable));", "_featureFlags.ActiveReviewerTrackingAvailable) &", "_featureFlags.ActiveReviewerTrackingAvailable", "_featureFlags.ActiveReviewerTrackingAvailable))", "_featureFlags.ActiveReviewerTrackingAvailable) &", "_featureFlags.ActiveReviewerTrackingAvailable) |", "if (_featureFlags.ReviewEligibilityPolicy)", "var writesEnabled = _featureFlags.MaterializedProjectStatisticsWrites;", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "var writesEnabled = _featureFlags.MaterializedProjectStatisticsWrites;", "var writesEnabled = _featureFlags.MaterializedProjectStatisticsWrites;", "var trackingAvailable = _featureFlags.ActiveReviewerTrackingAvailable;", "var writesEnabled = _featureFlags.MaterializedProjectStatisticsWrites;", "var trackingAvailable = _featureFlags.ActiveReviewerTrackingAvailable;", "var writesEnabled = _featureFlags.MaterializedProjectStatisticsWrites;", "var writesEnabled = _featureFlags.MaterializedProjectStatisticsWrites;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/Repositories/StudyRepository.ActivityReservations.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "_featureFlags.ProportionalStudyAllocation);", "if (!_featureFlags.ReviewEligibilityPolicy)", "var statisticsWrites = _featureFlags.MaterializedProjectStatisticsWrites;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/Repositories/StudyRepository.ActivityReviewWrites.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "if (!_featureFlags.ReviewEligibilityPolicy)", "var statisticsWrites = _featureFlags.MaterializedProjectStatisticsWrites;", "if (!_featureFlags.ReviewEligibilityPolicy)", "if (!_featureFlags.ReviewEligibilityPolicy)", "var statisticsWrites = _featureFlags.MaterializedProjectStatisticsWrites;", "_currentUserService.GetSyrfAppGroups(), _featureFlags.ProportionalStudyAllocation);" ] }, "src/libs/webhostconfig/SyRF.WebHostConfig.Common/Extensions/BulkPdfUploadEnablement.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "public const string UploadsFlagKey = \"FeatureFlags:BulkPdfUpload\";" ] }, "src/libs/webhostconfig/SyRF.WebHostConfig.Common/Extensions/SyrfConfigureServices.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "var featureFlags = configuration.GetSection(\"FeatureFlags\").Get() ?? new FeatureFlags();", "ValidateFeatureFlagCompatibility(featureFlags);", "services.AddSingleton(featureFlags);", "private static void ValidateFeatureFlagCompatibility(FeatureFlags featureFlags)", "if (featureFlags.BulkPdfUpload && !featureFlags.DeletionLifecycle)", "\"FeatureFlags:BulkPdfUpload requires FeatureFlags:DeletionLifecycle so deletion cannot bypass server-owned upload cleanup.\");" ] }, "src/services/api/SyRF.API.Endpoint/Authorization/ApplicationAuthority/ApplicationAuthorityMode.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Application-authority M1a mode, resolved once at API startup from deployed values; deliberately not runtime-overridable; enforced without the base flag fails startup", "reads": [ "public static ApplicationAuthorityMode Resolve(FeatureFlags featureFlags)", "ArgumentNullException.ThrowIfNull(featureFlags);", "if (featureFlags.SyrfOwnedApplicationRolesEnforced && !featureFlags.SyrfOwnedApplicationRoles)", "\"FeatureFlags:SyrfOwnedApplicationRolesEnforced requires FeatureFlags:SyrfOwnedApplicationRoles.\");", "return featureFlags switch" ] }, "src/services/api/SyRF.API.Endpoint/Authorization/ApplicationAuthority/ApplicationSuspensionSettings.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Application-authority M4a reversible application suspension, resolved once at API startup from deployed values; deliberately not runtime-overridable; on without enforced application authority fails startup", "reads": [ "public static ApplicationSuspensionSettings Resolve(FeatureFlags featureFlags, ApplicationAuthorityMode mode)", "ArgumentNullException.ThrowIfNull(featureFlags);", "if (featureFlags.ApplicationSuspension && mode != ApplicationAuthorityMode.Enforced)", "\"FeatureFlags:ApplicationSuspension requires enforced application authority \" +", "\"(FeatureFlags:SyrfOwnedApplicationRoles and FeatureFlags:SyrfOwnedApplicationRolesEnforced).\");", "return new ApplicationSuspensionSettings(featureFlags.ApplicationSuspension);" ] }, "src/services/api/SyRF.API.Endpoint/Authorization/SupportImpersonation/SupportImpersonationSettings.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Application-authority M2b support-impersonation contract, resolved once at API startup from deployed values; deliberately not runtime-overridable; on without enforced application authority fails startup", "reads": [ "public static SupportImpersonationSettings Resolve(FeatureFlags featureFlags, ApplicationAuthorityMode mode)", "ArgumentNullException.ThrowIfNull(featureFlags);", "if (featureFlags.ImpersonationReadOnlyEnforcement && mode != ApplicationAuthorityMode.Enforced)", "\"FeatureFlags:ImpersonationReadOnlyEnforcement requires enforced application authority \" +", "\"(FeatureFlags:SyrfOwnedApplicationRoles and FeatureFlags:SyrfOwnedApplicationRolesEnforced).\");", "return new SupportImpersonationSettings(featureFlags.ImpersonationReadOnlyEnforcement);" ] }, "src/services/api/SyRF.API.Endpoint/Authorization/FeatureGatedAttribute.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "Per request, before authorization: route admission reads IFeatureDecisions (Membership reader mode: one shared observation; Shared mode: bound authority; otherwise the runtime provider's values); a missing registration hides the route", "reads": [ "var decisions = routeContext.HttpContext.RequestServices.GetService();" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/BulkPdfUploadController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly FeatureFlags _featureFlags;", "FeatureFlags featureFlags,", "_featureFlags = featureFlags;", "private bool FeatureDisabled => !_featureFlags.BulkPdfUpload;" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/ProjectController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit. DeletionLifecycle: off = production's legacy immediate deletion, on = typed 503 until the reversible lifecycle lands (owner decision 2026-10-14)", "reads": [ "private readonly FeatureFlags _featureFlags;", "FeatureFlags featureFlags,", "_featureFlags = featureFlags;", "if (!_featureFlags.ActiveReviewerTrackingEnabled && ContainsActiveReviewerTrackingSetting(patchDoc))", "if (!_featureFlags.MaterializedProjectStatisticsPages || !_featureFlags.MaterializedProjectStatisticsProjectOverview)", "if (!_featureFlags.ReviewEligibilityPolicy && stageDto.AdditionalScreeningPolicy.HasValue)", "if (_featureFlags.ReviewEligibilityPolicy)", "if (_featureFlags.ReviewEligibilityPolicy)", "if (_featureFlags.DeletionLifecycle)" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/ProjectStatisticsParityAdminController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags,", "if (!flags.IsProjectAllowlisted(projectId))", "if (!flags.MaterializedWritesRequested || !flags.IsFamilyServingRequested(metricFamily))" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/ProjectStatisticsPilotAdminController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags,", "FeatureFlags featureFlags,", "if (!flags.IsProjectAllowlisted(id)) continue;", "return Ok(new ProjectStatisticsPilotStatusDto(flags.MaterializedWritesRequested,", "flags.MaterializedServingRequested,", "flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ProjectScreening),", "flags.PagesConsumerEnabled, featureFlags.MaterializedProjectStatisticsProjectOverview," ] }, "src/services/api/SyRF.API.Endpoint/Controllers/ReviewController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IRuntimeFeatureFlagProvider runtimeFeatureFlags,", "FeatureFlags featureFlags,", "if (featureFlags.ReviewEligibilityPolicy &&", "if (featureFlags.ReviewEligibilityPolicy)", "var writesEnabled = featureFlags.MaterializedProjectStatisticsWrites;", ": featureFlags.ActiveReviewerTrackingAvailable;", "(!featureFlags.ReviewEligibilityPolicy ||", "activityClaims: featureFlags.ReviewEligibilityPolicy);", "if (featureFlags.ReviewEligibilityPolicy)", "var target = new AnnotationDeletionFoldTarget(pmUnitOfWork, reviewSessionConnectionRepository, featureFlags,", "runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation))", "keepSlottedClaim: featureFlags.ReviewEligibilityPolicy))", "getSavedSession, runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.MaxInProgressSessions),", "runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation));", "getSavedSession, runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.MaxInProgressSessions),", "runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation));", "restrictToSavedSessions, runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.MaxInProgressSessions),", "runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation));", "if (!featureFlags.ReviewEligibilityPolicy && !reconciliation", "if (featureFlags.ReviewEligibilityPolicy)", "var target = new ReviewScreeningFoldTarget(pmUnitOfWork, reviewSubmissionService, currentUserService, featureFlags,", "var writesEnabled = featureFlags.MaterializedProjectStatisticsWrites;", ": featureFlags.ActiveReviewerTrackingAvailable;", "if (featureFlags.ReviewEligibilityPolicy)", "restrictToSavedSessions, runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.MaxInProgressSessions),", "runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation));", "if (!featureFlags.MaterializedProjectStatisticsPages || !screeningStatisticsQuery.IsMaterializedReadRequested(projectId))", "var ensureAnnotationAccess = featureFlags.MaterializedProjectStatisticsWrites", "|| featureFlags.ActiveReviewerTrackingAvailable;", "if (!reconciliation && runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation) &&", "keepSlottedClaim: featureFlags.ReviewEligibilityPolicy))", "var hasReachedMaxInProgress = runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.MaxInProgressSessions) &&", "if (!featureFlags.ActiveReviewerTrackingAvailable ||", "if (!featureFlags.ReviewEligibilityPolicy || study is null)", "runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation));", "featureFlags.ReviewEligibilityPolicy", "featureFlags.ReviewEligibilityPolicy ? throw new ReviewWriteRefusedException(reason) : flagOffResult;" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/RuntimeFeatureFlagsController.cs": { "classification": "control-plane", "owner": "API maintainers", "scope": "api", "activationBoundary": "Flag-manager authorization before local provider/authority status; no anonymous authority, targeting or fleet view; mutations retain deployment constraints; a Legacy host with preserved authority refuses legacy mutations (6C.5)", "reads": [ "[FromServices] SharedRuntimeFeatureFlagReader reader,", "var observed = reader.Capture();", "options.Enabled && observed.State is \"Current\" or SharedRuntimeFeatureFlagReader.AuthorityPreservedState", "? reader.Evaluate(SharedRuntimeFeatureFlagOptions.ConsumerKey, options.MembershipDefault) : null,", ": reader.Capture();" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/SearchController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit. DeletionLifecycle: off = production's legacy immediate deletion, on = typed 503 until the reversible lifecycle lands (owner decision 2026-10-14)", "reads": [ "FeatureFlags featureFlags, ISearchPopulationQuery? searchPopulation = null, ICurrentUserService? currentUser = null,", "_featureFlags = featureFlags;", "private readonly FeatureFlags _featureFlags;", "if (_featureFlags.DeletionLifecycle)", "if (_featureFlags.DeletionLifecycle)" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/StageReviewSettingsController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "ICurrentUserService currentUser, FeatureFlags flags, IStageReviewStatisticsEvidenceReader statisticsEvidence,", "if (!flags.ReviewEligibilityPolicy) return NotFound();", "if (!flags.ReviewEligibilityPolicy) return NotFound();", "var plans = studies.Select(study => (Study: study, Changes: Plan(study, project, stage, flags.ProportionalStudyAllocation))).ToArray();", "var statisticsThresholds = flags.MaterializedProjectStatisticsWrites &&" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/StageAllocationReadController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IRuntimeFeatureFlagProvider runtimeFeatureFlags, ICurrentUserService currentUserService) : ControllerBase", "if (!runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation))", "runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.MaxInProgressSessions));", "if (!runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation))", "runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.MaxInProgressSessions));" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/StageWorkloadSharesController.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IRuntimeFeatureFlagProvider runtimeFeatureFlags,", "if (request.Enabled && !runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation))" ] }, "src/services/api/SyRF.API.Endpoint/Infrastructure/ReviewWriteAuthorizationResultHandler.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "public sealed class ReviewWriteAuthorizationResultHandler(FeatureFlags featureFlags) : IAuthorizationMiddlewareResultHandler", "if (authorizeResult.Forbidden && featureFlags.ReviewEligibilityPolicy && !context.Response.HasStarted &&" ] }, "src/services/api/SyRF.API.Endpoint/Program.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "var deployedFeatureFlags = context.Configuration.GetSection(\"FeatureFlags\").Get() ?? new FeatureFlags();", ".AddSingleton(resolver =>", "registry.AddScoped();" ] }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/RuntimeFeatureFlagProvider.cs": { "classification": "control-plane", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "public interface IRuntimeFeatureFlagProvider", "public sealed class RuntimeFeatureFlagProvider : IRuntimeFeatureFlagProvider, IFeatureFlagCompatibilityValues", "private readonly FeatureFlags _backendFlags;", "public RuntimeFeatureFlagProvider(IConfiguration configuration, FeatureFlags backendFlags,", "normalized.TryAdd(RuntimeFeatureFlagKeys.ReviewEligibilityPolicy, _backendFlags.ReviewEligibilityPolicy);", "_backendFlags.ProportionalStudyAllocation);", "_backendFlags.BulkPdfUpload = values[RuntimeFeatureFlagKeys.BulkPdfUpload];", "_backendFlags.MaxInProgressSessions = values[RuntimeFeatureFlagKeys.MaxInProgressSessions];", "_backendFlags.ReviewEligibilityPolicy = values[RuntimeFeatureFlagKeys.ReviewEligibilityPolicy];", "_backendFlags.ProportionalStudyAllocation = values[RuntimeFeatureFlagKeys.ProportionalStudyAllocation];", "value => _backendFlags.MaterializedProjectStatisticsWrites = value);", "value => _backendFlags.MaterializedProjectStatisticsServing = value);", "value => _backendFlags.MaterializedProjectStatisticsScreening = value);", "value => _backendFlags.MaterializedProjectStatisticsMembershipScreening = value);", "value => _backendFlags.MaterializedProjectStatisticsAnnotation = value);", "value => _backendFlags.MaterializedProjectStatisticsMembershipAnnotation = value);", "value => _backendFlags.MaterializedProjectStatisticsQuestionAnswers = value);", "value => _backendFlags.MaterializedProjectStatisticsSearchPopulation = value);", "value => _backendFlags.MaterializedProjectStatisticsDerivedSummaries = value);", "value => _backendFlags.MaterializedProjectStatisticsFold = value);", "value => _backendFlags.MaterializedProjectStatisticsProjectOverview = value);", "value => _backendFlags.MaterializedProjectStatisticsHistory = value);", "value => _backendFlags.MaterializedProjectStatisticsReviewerAnnotationHistory = value);", "value => _backendFlags.MaterializedProjectStatisticsStageHistory = value);", "value => _backendFlags.MaterializedProjectStatisticsReviewerHistory = value);", "value => _backendFlags.MaterializedProjectStatisticsQuestionCounts = value);", "value => _backendFlags.MaterializedProjectStatisticsSearchCounts = value);", "value => _backendFlags.MaterializedProjectStatisticsStageOverviewBundle = value);", "value => _backendFlags.MaterializedProjectStatisticsScreeningInfo = value);", "value => _backendFlags.MaterializedProjectStatisticsStageOverview = value);", "value => _backendFlags.MaterializedProjectStatisticsReviewerProgress = value);", "value => _backendFlags.MaterializedProjectStatisticsProjectReviewerProgress = value);", "value => _backendFlags.MaterializedProjectStatisticsPages = value);", "value => _backendFlags.MaterializedProjectStatisticsSignalR = value);" ] }, "src/services/api/SyRF.API.Endpoint/Services/ProjectStatisticsProjectionReads.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "FeatureFlags featureFlags,", "if (!featureFlags.MaterializedProjectStatisticsPages || !featureFlags.MaterializedProjectStatisticsProjectOverview)" ] }, "src/services/api/SyRF.API.Endpoint/Services/RuntimeProjectStatisticsFlagSource.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "Per read: statistics switches through IFeatureDecisions (the runtime provider's values; Shared-mode contract keys through the bound authority); ActiveReviewerTrackingAvailable stays deployed configuration", "reads": [ "IFeatureDecisions decisions,", "FeatureFlags featureFlags,", "ProjectStatisticsAllowlist allowlist) : IProjectStatisticsFlagSource", "decisions.Decide(RuntimeFeatureFlagKeys.MaterializedProjectStatisticsWrites).Value;", "decisions.Decide(RuntimeFeatureFlagKeys.MaterializedProjectStatisticsFold).Value;", "decisions.Decide(RuntimeFeatureFlagKeys.MaterializedProjectStatisticsServing).Value,", "ProjectStatisticsFlagMap.FamilyFlagKey(metricFamily) is { } key && decisions.Decide(key).Value;", "public bool StageOverviewBundleConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.StageOverviewBundleKey).Value;", "public bool ScreeningInfoConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.ScreeningInfoKey).Value;", "public bool ReviewerProgressConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.ReviewerProgressKey).Value;", "public bool ProjectReviewerProgressConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.ProjectReviewerProgressKey).Value;", "public bool PagesConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.PagesKey).Value;", "decisions.Decide(ProjectStatisticsFlagMap.StageOverviewKey).Value;", "public bool SignalRConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.SignalRKey).Value;", "public bool ActiveReviewerTrackingAvailable => featureFlags.ActiveReviewerTrackingAvailable;" ] }, "src/services/api/SyRF.API.Endpoint/Services/SubmitAnnotationSessionService.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly FeatureFlags _featureFlags;", "private readonly IRuntimeFeatureFlagProvider _runtimeFeatureFlags;", "FeatureFlags featureFlags,", "IRuntimeFeatureFlagProvider runtimeFeatureFlags,", "_featureFlags = featureFlags;", "_runtimeFeatureFlags = runtimeFeatureFlags;", "_runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation);", "if (_featureFlags.ReviewEligibilityPolicy)", "var writesEnabled = _featureFlags.MaterializedProjectStatisticsWrites;", ": _featureFlags.ActiveReviewerTrackingAvailable;", "keepSlottedClaim: _featureFlags.ReviewEligibilityPolicy)", "if (_featureFlags.ReviewEligibilityPolicy)", "catch (DuplicateAnnotationSessionException) when (_featureFlags.ReviewEligibilityPolicy)", "if (_featureFlags.ReviewEligibilityPolicy)", "_featureFlags, _runtimeFeatureFlags, _currentUserService," ] }, "src/services/api/SyRF.API.Endpoint/SignalR/NotificationHub.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "FeatureFlags featureFlags,", "ApplicationAuthorityModes.Resolve(featureFlags));", "_featureFlags = featureFlags;", "private readonly FeatureFlags _featureFlags;", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "wasRemoved = await ReservationChangeSave.SaveOrThrowAsync(_pmUnitOfWork, _featureFlags,", "var rolledBack = await ReservationChangeSave.TrySaveAsync(_pmUnitOfWork, _featureFlags,", "if (await ReservationChangeSave.SaveOrThrowAsync(_pmUnitOfWork, _featureFlags, priorStudy,", "if (_featureFlags.MaterializedProjectStatisticsWrites)", "else if (!_featureFlags.ActiveReviewerTrackingAvailable)", "if (_featureFlags.ReviewEligibilityPolicy)", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "var removal = await ReservationChangeSave.TrySaveAsync(_pmUnitOfWork, _featureFlags, study,", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "if (!_featureFlags.ActiveReviewerTrackingAvailable)", "_featureFlags.MaterializedProjectStatisticsFold, study,", "_featureFlags.MaterializedProjectStatisticsFold, study," ] }, "src/services/api/SyRF.API.Endpoint/SignalR/Statistics/ProjectStatisticsChangedConsumer.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags,", "if (!flags.SignalRConsumerEnabled) return;", "if (!flags.IsProjectAllowlisted(group.Key)) continue;" ] }, "src/services/api/SyRF.API.Endpoint/SignalR/Statistics/ProjectStatisticsDispatchService.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "if (!scope.ServiceProvider.GetRequiredService().SignalRConsumerEnabled) continue;" ] }, "src/services/api/SyRF.API.Endpoint/SignalR/Statistics/ProjectStatisticsNotificationSink.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IBus bus, IProjectStatisticsControlRepository controls, IProjectStatisticsFlagSource flags)", "if (!flags.SignalRConsumerEnabled)" ] }, "src/services/identity/SyRF.Identity.Endpoint/Configuration/IdentityHostOptions.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "identity", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit; Application-authority M1c: the API's deployment-only authority pair, bound once at Identity startup (not runtime-overridable); enforced requires the base flag; when enforced, destructive account deletions require the PM pending-deactivation reservation; #3896: applicationSuspension (the API's deployment-only M4a flag, one Helm value) is bound once at Identity startup and requires enforced authority; when on, Identity refuses sign-in and token issuance to suspended accounts", "reads": [ "public IdentityFeatureFlags FeatureFlags { get; init; } = new();", "FeatureFlags = configuration.GetSection(\"FeatureFlags\").Get() ?? new(),", "if (options.FeatureFlags.SyrfOwnedApplicationRolesEnforced && !options.FeatureFlags.SyrfOwnedApplicationRoles)", "\"FeatureFlags:SyrfOwnedApplicationRolesEnforced requires FeatureFlags:SyrfOwnedApplicationRoles.\");", "if (options.FeatureFlags.ApplicationSuspension && !options.FeatureFlags.ApplicationAuthorityEnforced)", "\"FeatureFlags:ApplicationSuspension requires enforced application authority \"", "+ \"(FeatureFlags:SyrfOwnedApplicationRoles and FeatureFlags:SyrfOwnedApplicationRolesEnforced).\");" ] }, "src/services/identity/SyRF.Identity.Endpoint/Program.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "identity", "activationBoundary": "#3896: applicationSuspension, bound once at Identity startup (not runtime-overridable); on, registers the linearizable PM suspension check (or a fail-closed check without a PM connection in Development); off, the disabled check reads and refuses nothing", "reads": [ "if (hostOptions.FeatureFlags.ApplicationSuspension)", "if (hostOptions.FeatureFlags.ApplicationSuspension)" ] }, "src/services/identity/SyRF.Identity.Endpoint/Controllers/AccountApiController.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "identity", "activationBoundary": "Application-authority M1c: the API's deployment-only authority pair, bound once at Identity startup (not runtime-overridable); enforced requires the base flag; when enforced, destructive account deletions require the PM pending-deactivation reservation", "reads": [ "_applicationAuthorityEnforced = hostOptions?.FeatureFlags.ApplicationAuthorityEnforced ?? false;" ] }, "src/services/identity/SyRF.Identity.Endpoint/Controllers/AdminApiController.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "identity", "activationBoundary": "Application-authority M1c: the API's deployment-only authority pair, bound once at Identity startup (not runtime-overridable); enforced requires the base flag; when enforced, destructive account deletions require the PM pending-deactivation reservation", "reads": [ "_applicationAuthorityEnforced = hostOptions?.FeatureFlags.ApplicationAuthorityEnforced ?? false;" ] }, "src/services/identity/SyRF.Identity.Endpoint/Controllers/AuthorizationController.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "identity", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "if (_hostOptions.FeatureFlags.IdentityClaimRecovery" ] }, "src/services/identity/SyRF.Identity.Endpoint/Pages/Account/ClaimPending.cshtml.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "identity", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "if (!hostOptions.FeatureFlags.IdentityClaimRecovery)", "if (!hostOptions.FeatureFlags.IdentityClaimRecovery)" ] }, "src/services/identity/SyRF.Identity.Endpoint/Services/IdentityAdmissionMiddleware.cs": { "classification": "startup-or-domain-bound", "owner": "Shared platform maintainers", "scope": "identity", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "if (IsAllowed(context.Request.Path, hostOptions.FeatureFlags.IdentityClaimRecovery))" ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Consumers/CheckConnectionLivenessConsumer.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "FeatureFlags featureFlags,", "featureFlags.MaterializedProjectStatisticsFold, study," ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Consumers/MarkSessionIdleConsumer.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "FeatureFlags featureFlags,", "await StudyUpsertConflictRetry.ExecuteAsync(featureFlags.MaterializedProjectStatisticsFold, study," ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Consumers/RemoveIdleSessionConsumer.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "FeatureFlags featureFlags,", "var wasRemoved = await ReservationChangeSave.SaveOrThrowAsync(pmUnitOfWork, featureFlags, study,", "await StudyUpsertConflictRetry.ExecuteAsync(featureFlags.MaterializedProjectStatisticsFold, study," ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Consumers/RemoveSuspendedSessionConsumer.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "FeatureFlags featureFlags,", "await ReservationChangeSave.SaveOrThrowAsync(pmUnitOfWork, featureFlags, study," ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Consumers/StudyUpdateJobFileSavedToS3Comsumer.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit; ADR-020: the restoration guard admits execution versions 1 and 2 (version 0 rejected as before); a version 2 job is handed to the atomic executor whatever bulkStudyUpdateAtomicApply says (with the guard off, the version 1 parse refuses it before writing)", "reads": [ "private readonly FeatureFlags _featureFlags;", "FeatureFlags featureFlags, IDelegatedWorkGate delegatedWork,", "_featureFlags = featureFlags;", "if (_featureFlags.BulkStudyUpdateRequireCurrentExecutionVersion)" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/ProjectStatisticsHistoryController.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "History endpoint requires the page, history and screening flags and checks Project.View plus screening-progress permission before snapshot reauthorization", "reads": [ "IPmUnitOfWork unitOfWork, ICurrentUserService currentUser, FeatureFlags flags,", "if (!flags.MaterializedProjectStatisticsPages || !flags.MaterializedProjectStatisticsHistory", "|| !flags.MaterializedProjectStatisticsScreening)" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/StageStatisticsHistoryController.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "Stage annotation history endpoint requires the page, stage-history and annotation flags and checks Project.View plus the stage's annotation-progress-graph permission before snapshot reauthorization", "reads": [ "IPmUnitOfWork unitOfWork, ICurrentUserService currentUser, FeatureFlags flags,", "if (!flags.MaterializedProjectStatisticsPages || !flags.MaterializedProjectStatisticsStageHistory", "|| !flags.MaterializedProjectStatisticsAnnotation)" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/ReviewerScreeningHistoryController.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "Reviewer screening history endpoint requires the page, reviewer-history and membership-screening flags and applies the reviewer-leaderboard disclosure tiers (Project.View, screening-progress graph, decisions for peers plus membership visibility) before snapshot reauthorization", "reads": [ "IPmUnitOfWork unitOfWork, ICurrentUserService currentUser, FeatureFlags flags,", "var reviewerHistoryRequested = flags.MaterializedProjectStatisticsPages", "&& flags.MaterializedProjectStatisticsReviewerHistory", "&& flags.MaterializedProjectStatisticsMembershipScreening;" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/ReviewerAnnotationHistoryController.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "Reviewer annotation history endpoint requires the page, reviewer-annotation-history, annotation and membership-annotation flags and applies the membership-stage annotation disclosure tiers (Project.View, the stage's annotation-progress graph, membership visibility for peers, active membership for own history) before snapshot reauthorization", "reads": [ "IPmUnitOfWork unitOfWork, ICurrentUserService currentUser, FeatureFlags flags,", "if (!flags.MaterializedProjectStatisticsPages || !flags.MaterializedProjectStatisticsReviewerAnnotationHistory", "|| !flags.MaterializedProjectStatisticsAnnotation || !flags.MaterializedProjectStatisticsMembershipAnnotation)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/ReviewerProgressAuthoritativeQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsGlobalControlRepository globals, IProjectStatisticsFlagSource flags)", "if (global is not null && global.ActiveReviewerTrackingAvailable != flags.ActiveReviewerTrackingAvailable)", "global?.ActiveReviewerTrackingAvailable ?? flags.ActiveReviewerTrackingAvailable," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/ReviewerProgressQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags, ReviewerProgressAuthoritativeQuery authoritative,", "public bool IsMaterializedReadRequested(Guid projectId) => flags.ReviewerProgressConsumerEnabled", "&& flags.PagesConsumerEnabled && flags.MaterializedWritesRequested && flags.MaterializedServingRequested", "&& flags.IsProjectAllowlisted(projectId)", "&& flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ReviewerScreening)", "&& flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ReviewerAnnotation);", "ProjectStatisticsConsumerReadObservation.GateReason(flags.ReviewerProgressConsumerEnabled, flags, projectId," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsHistoryMaintenanceService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Administrator-only checkpoint history maintenance (FEAT-024), evaluated per request: ProjectStatistics:HistoryMaintenance:Enabled stays default-off and the project must also be allowlisted; a refusal writes nothing, and every pass serializes with checkpoint admission through the admission-row compare-and-swap", "reads": [ "IProjectStatisticsFlagSource flags,", "if (projectId == Guid.Empty || !flags.IsProjectAllowlisted(projectId)) throw Refused(\"ProjectNotAdmitted\");" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsDeltaMaintenanceService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Administrator-only delta ledger maintenance (FEAT-024), evaluated per request: ProjectStatistics:DeltaMaintenance:Enabled stays default-off and the project must also be allowlisted; a refusal writes nothing, and every pass serializes with checkpoint admission, family guards and the project control through compare-and-swap in one snapshot transaction", "reads": [ "IProjectStatisticsFlagSource flags)", "if (projectId == Guid.Empty || !flags.IsProjectAllowlisted(projectId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsReceiptMaintenanceService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Administrator-only source-receipt maintenance (FEAT-024), evaluated per request: ProjectStatistics:ReceiptMaintenance:Enabled stays default-off and the project must also be allowlisted; a refusal writes nothing, and every pass retires source revisions, deletes receipts and advances the idempotency floor in one snapshot transaction that serializes with source writes through the project-control compare-and-swap", "reads": [ "if (projectId == Guid.Empty || !flags.IsProjectAllowlisted(projectId)) throw Refused(\"ProjectNotAdmitted\");", "IProjectStatisticsFlagSource flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsScheduledMaintenanceRunner.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Scheduled bounded maintenance (FEAT-024) runs only in the PM host when the default-off ProjectStatisticsMaintenance:Enabled option is true; each run visits at most ProjectsPerRun projects taken from the reviewed ProjectStatistics:ProjectAllowlist, skipping any the host flag source does not also admit; every call still passes the history, delta or receipt service's own default-off ProjectStatistics:*Maintenance:Enabled gate and allowlist check, receipt reclamation additionally needs the default-off ProjectStatisticsMaintenance:ReceiptMaintenanceEnabled, and a typed refusal writes nothing and is retried by the next run", "reads": [ "IProjectStatisticsFlagSource flags,", ".Where(projectId => projectId != Guid.Empty && flags.IsProjectAllowlisted(projectId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Fleet/ProjectStatisticsFleetService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Admission-only reads (allowlist, write kill switch, family flag) evaluated per create/advance; ProjectStatistics:Fleet:Enabled stays default-off and each dispatched backfill re-checks the same gates", "reads": [ "IProjectStatisticsFlagSource flags,", "|| !flags.MaterializedWritesRequested || !flags.IsFamilyServingRequested(target.Family)", "|| !flags.IsProjectAllowlisted(target.ProjectId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/StageOverviewStatisticsQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Stage Overview bundle consumer (FEAT-024), default off; the API runtime provider mirrors materializedProjectStatisticsStageOverviewBundle into the statistics flag source, and the projection path also requires pages consumers, writes, serving, all four stage-overview families and the project allowlist. A disabled response restores the legacy FullStats page; refusals never fall through to raw facets. The durable reviewer-mode check fails closed with the typed 503. The Screening Information consumer (materializedProjectStatisticsScreeningInfo, default off) uses the same query through IsScreeningEnabled: pages consumers, writes, serving, the project and membership screening families and the project allowlist; a disabled response restores the legacy FullStats page.", "reads": [ "public bool IsEnabled(Guid projectId) => flags.StageOverviewBundleConsumerEnabled && flags.PagesConsumerEnabled", "&& flags.MaterializedWritesRequested && flags.MaterializedServingRequested && flags.IsProjectAllowlisted(projectId)", ".All(flags.IsFamilyServingRequested);", "if (global is not null && global.ActiveReviewerTrackingAvailable != flags.ActiveReviewerTrackingAvailable)", "IProjectStatisticsFlagSource flags, ILogger logger) : IStageOverviewStatisticsQuery", "public bool IsScreeningEnabled(Guid projectId) => flags.ScreeningInfoConsumerEnabled && flags.PagesConsumerEnabled", "&& flags.MaterializedWritesRequested && flags.MaterializedServingRequested && flags.IsProjectAllowlisted(projectId)", ".All(flags.IsFamilyServingRequested);", "? ProjectStatisticsConsumerReadObservation.GateReason(flags.ScreeningInfoConsumerEnabled, flags, projectId,", ": ProjectStatisticsConsumerReadObservation.GateReason(flags.StageOverviewBundleConsumerEnabled, flags, projectId," ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Controllers/RuntimeFeatureFlagReaderController.cs": { "classification": "control-plane", "owner": "Project Management maintainers", "scope": "Project Management local diagnostic endpoint", "activationBoundary": "Read-only status for the responding instance; no policy mutation or fleet convergence claim; preserved authority reports deployed switches (6C.5)", "reads": [ "SharedRuntimeFeatureFlagReader reader,", "IProjectStatisticsFlagSource statistics) : ControllerBase", "var observed = reader.Capture();", "&& observed.State is \"Current\" or SharedRuntimeFeatureFlagReader.AuthorityPreservedState;", "var preserved = options.Enabled && observed.State == SharedRuntimeFeatureFlagReader.AuthorityPreservedState;", "known ? statistics.MaterializedServingRequested : null,", "known ? statistics.PagesConsumerEnabled : null,", "known ? statistics.SignalRConsumerEnabled : null," ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Program.cs": { "classification": "shared-reader", "owner": "Project Management maintainers", "scope": "Project Management host registration", "activationBoundary": "Replace the statistics adapter only when non-production StatisticsServing mode is selected; Shadow and Disabled retain legacy behavior", "reads": [ "registry.For().Use().Singleton();", "registry.For().Use().Singleton();" ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Services/SharedProjectStatisticsFlagSource.cs": { "classification": "shared-reader", "owner": "Project Management maintainers", "scope": "Project Management statistics serving and consumer gates", "activationBoundary": "A current shared Off stops new serving and consumer selection; stale or unavailable policy fails closed; deployment writes and serving, durable readiness, and allowlist remain prerequisites", "reads": [ "public sealed class SharedProjectStatisticsFlagSource : IProjectStatisticsFlagSource", "private readonly IFeatureDecisions _decisions;", "FeatureFlags featureFlags,", "IFeatureDecisions decisions)", "_deployed = new FeatureFlagsProjectStatisticsFlagSource(featureFlags, allowlist);", "&& _decisions.Decide(SharedRuntimeFeatureFlagOptions.StatisticsServingKey).Value;", "public bool PagesConsumerEnabled => _decisions.Decide(ProjectStatisticsFlagMap.PagesKey).Value;", "public bool StageOverviewConsumerEnabled => _decisions.Decide(ProjectStatisticsFlagMap.StageOverviewKey).Value;", "public bool SignalRConsumerEnabled => _decisions.Decide(ProjectStatisticsFlagMap.SignalRKey).Value;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/Annotation/ProjectReviewerProgressQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IProjectStatisticsFlagSource flags, ILogger logger) : IProjectReviewerProgressQuery", "public bool IsReadRequested(Guid projectId) => flags.ProjectReviewerProgressConsumerEnabled && flags.PagesConsumerEnabled;", "public bool IsMaterializedReadRequested(Guid projectId) => flags.ProjectReviewerProgressConsumerEnabled", "&& flags.PagesConsumerEnabled && flags.MaterializedWritesRequested && flags.MaterializedServingRequested", "&& flags.IsProjectAllowlisted(projectId)", "&& flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ReviewerScreening)", "&& flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ReviewerAnnotation);", "if (global is not null && global.ActiveReviewerTrackingAvailable != flags.ActiveReviewerTrackingAvailable)", "return (project, global?.ActiveReviewerTrackingAvailable ?? flags.ActiveReviewerTrackingAvailable);", "ProjectStatisticsConsumerReadObservation.GateReason(flags.ProjectReviewerProgressConsumerEnabled, flags," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Families/SearchPopulation/SearchPopulationQuery.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Imported search count consumer (FEAT-024), default off; the API runtime provider mirrors materializedProjectStatisticsSearchCounts into FeatureFlags, and the projection path also requires pages consumers, writes, serving, the search population family and the project allowlist. Missing, stale or incompatible projections return the authorized metadata snapshot; fences (including active search operation fences) and capacity refuse explicitly", "reads": [ "IProjectStatisticsFlagSource flags,", "FeatureFlags consumerFlags, ILogger logger) : ISearchPopulationQuery", "public bool IsEnabled(Guid projectId) => consumerFlags.MaterializedProjectStatisticsSearchCounts", "&& flags.PagesConsumerEnabled && flags.MaterializedWritesRequested && flags.MaterializedServingRequested", "&& flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.SearchPopulation) && flags.IsProjectAllowlisted(projectId);", "if (global is not null && global.ActiveReviewerTrackingAvailable != flags.ActiveReviewerTrackingAvailable)", "ProjectStatisticsConsumerReadObservation.GateReason(consumerFlags.MaterializedProjectStatisticsSearchCounts," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ReviewEligibility/ReviewEligibilityService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Default-off reviewEligibilityPolicy; flag off returns before any read or evaluation; no runtime enrollment without operation audit", "reads": [ "FeatureFlags featureFlags,", "if (!featureFlags.ReviewEligibilityPolicy)", "var trackingAvailable = featureFlags.MaterializedProjectStatisticsWrites", ": featureFlags.ActiveReviewerTrackingAvailable;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Read/ProjectStatisticsServingGate.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "The serving equality gate extracted unchanged from ProjectStatisticsBundleReader and shared with the #3636 daily copy; it evaluates the same serving, allowlist and family flags per read that the reader always did; no shared runtime enrollment without operation audit", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags)", "if (!_flags.MaterializedServingRequested)", "if (!_flags.IsProjectAllowlisted(projectId))", "if (!_flags.IsFamilyServingRequested(family))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsCurrentRowCopier.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Reached only from an ordinary daily observation when the default-off ProjectStatisticsDailyObservations:CopyFreshMaterializedRows option is on; per delivery it checks the durable reviewer mode against the flag and applies the reader's serving gate before copying any row; any refusal calculates from source; no shared runtime enrollment without operation audit; a project with fold history is copied only while its pending set is empty in the same snapshot", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "if (globalControl.ActiveReviewerTrackingAvailable != _flags.ActiveReviewerTrackingAvailable" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsDriftCheckRunner.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "The #3636 periodic drift check runs only in the PM host when the default-off ProjectStatisticsDriftCheck:Enabled option is true; each run visits at most ProjectsPerRun projects taken from the reviewed ProjectStatistics:ProjectAllowlist, skipping any the host flag source does not also admit; a refusal, conflict or failure is isolated to its project and retried by the next run", "reads": [ "IProjectStatisticsFlagSource flags,", ".Where(projectId => projectId != Guid.Empty && flags.IsProjectAllowlisted(projectId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsDriftCheckService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Reached only from the default-off ProjectStatisticsDriftCheck schedule for allowlisted projects; per visit it checks the durable reviewer mode against the flag and compares each requested family's scopes through the reader's own serving gate, so with serving or a family flag off nothing is compared or written; a drifted served row is made Stale in one transaction that re-verifies the identity, and only verification records move otherwise", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "projectId != Guid.Empty && _allowlist.Contains(projectId) && _flags.IsProjectAllowlisted(projectId);", "if (global.ActiveReviewerTrackingAvailable != _flags.ActiveReviewerTrackingAvailable)", "if (global.ActiveReviewerTrackingAvailable != _flags.ActiveReviewerTrackingAvailable) return \"ReviewerModeDisagrees\";", "if (family == ProjectStatisticsMetricFamily.DerivedSummary || !_flags.IsFamilyServingRequested(family)) continue;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectManagementService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Default-off reviewEligibilityPolicy; flag off returns before any read or evaluation; no runtime enrollment without operation audit", "reads": [ "private readonly FeatureFlags _featureFlags;", "definitionRewriteFence, stagedOperationFences, new FeatureFlags())", "FeatureFlags featureFlags)", "_featureFlags = featureFlags ?? throw new ArgumentNullException(nameof(featureFlags));", "_featureFlags.ReviewEligibilityPolicy && job.ScreeningImportSettings is { UserColumnMap.Count: > 0 } screening", "if (_featureFlags.ReviewEligibilityPolicy &&" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ReviewEligibility/StageReviewStatisticsEvidence.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Statistics are consulted only when materialized writes, serving, the stage-annotation family and the project allowlist are all on; otherwise the authoritative stage-attributed check decides", "reads": [ "IProjectStatisticsFlagSource flags,", "if (!flags.MaterializedWritesRequested || !flags.MaterializedServingRequested ||", "!flags.IsFamilyServingRequested(AnnotationStatisticsClassifier.StageFamily) ||", "!flags.IsProjectAllowlisted(projectId))" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/StudyReferenceFileParser.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Default-off reviewEligibilityPolicy; flag off returns before any read or evaluation; no runtime enrollment without operation audit", "reads": [ "private readonly FeatureFlags _featureFlags;", "new FeatureFlags())", "IFileService fileService, IPmUnitOfWork unitOfWork, FeatureFlags featureFlags)", "_featureFlags = featureFlags ?? throw new ArgumentNullException(nameof(featureFlags));", "if (screeningUpdates.Length > 0 && _featureFlags.ReviewEligibilityPolicy)", "return _featureFlags.ReviewEligibilityPolicy" ] }, "src/services/api/SyRF.API.Endpoint/SignalR/ClaimRevocations/ActivityClaimRevocationDispatchService.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Default-off reviewEligibilityPolicy; flag off dispatches and delivers nothing (#3720); no runtime enrollment without operation audit", "reads": [ "if (!scope.ServiceProvider.GetRequiredService().ReviewEligibilityPolicy) continue;" ] }, "src/services/api/SyRF.API.Endpoint/SignalR/ClaimRevocations/ActivityClaimRevokedConsumer.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Default-off reviewEligibilityPolicy; flag off dispatches and delivers nothing (#3720); no runtime enrollment without operation audit", "reads": [ "IPmUnitOfWork unitOfWork, IHubContext hub, FeatureFlags flags,", "if (!flags.ReviewEligibilityPolicy) return false;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ReservationChangeSave.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "IPmUnitOfWork unitOfWork, FeatureFlags featureFlags, Study study, Guid stageId, Guid investigatorId,", "ArgumentNullException.ThrowIfNull(featureFlags);", "if (!featureFlags.MaterializedProjectStatisticsWrites)", "IPmUnitOfWork unitOfWork, FeatureFlags featureFlags, Study study, Guid stageId, Guid investigatorId,", "result = await TrySaveAsync(unitOfWork, featureFlags, study, stageId, investigatorId, change," ] }, "src/libs/project-management/SyRF.ProjectManagement.Mongo.Data/Repositories/StudyRepository.ReservationStatistics.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "if (!_featureFlags.MaterializedProjectStatisticsWrites)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsStaleRepairRunner.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "The FEAT-024 C1 scheduled repair runs only in the PM host when the default-off ProjectStatisticsRepair:Enabled option is true; each run visits at most ProjectsPerRun projects taken from the reviewed ProjectStatistics:ProjectAllowlist, skipping any the host flag source does not also admit; with materialized writes off, a disagreeing durable reviewer mode or a family flag off nothing is inspected or backfilled, and a family is repaired only through its ordinary non-forced backfill, which re-checks the allowlist, write and family flags itself", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", ".Where(projectId => projectId != Guid.Empty && _flags.IsProjectAllowlisted(projectId))", "var enabled = _backfills.Where(backfill => _flags.IsFamilyServingRequested(backfill.MetricFamily)).ToArray();", "if (!_flags.MaterializedWritesRequested) return ProjectStatisticsStaleRepairReason.WritesDisabled;", "if (global.ActiveReviewerTrackingAvailable != _flags.ActiveReviewerTrackingAvailable)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Fold/ProjectStatisticsFleetMembershipRenewal.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Per-pod FEAT-024 fleet membership, renewed every 30 s by the api and project-management hosts only while the deployment-pinned default-off materializedProjectStatisticsFold flag is on or the pod has a non-empty ProjectStatistics:ProjectAllowlist (#4285: a fold-off record carries FoldDisabled, which every fold rule ignores, and declares the families the pod's writers maintain, derived from the deployment-pinned writes and family flags); with neither (production: no allowlist) the pod writes nothing and deletes any record it wrote", "reads": [ "private readonly FeatureFlags _featureFlags;", "FeatureFlags featureFlags,", "_featureFlags = featureFlags ?? throw new ArgumentNullException(nameof(featureFlags));", "FoldDisabled = !_featureFlags.MaterializedProjectStatisticsFold,", "MaintainedFamilies = ProjectStatisticsWriterMaintenance.MaintainedFamilies(_featureFlags).ToList(),", "_featureFlags.MaterializedProjectStatisticsFold || _allowlist.ProjectIds.Count > 0;", "ProjectStatisticsWriterMaintenance.UnmaintainedFamilies(_featureFlags).Count > 0;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Fold/ProjectStatisticsFoldAdministration.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Async point fold (FEAT-024) administrative enable/disable/reset/status behind the administrator-only api/admin/project-statistics/{projectId}/fold routes: enable refuses unless the deployment-pinned default-off materializedProjectStatisticsFold flag is on and the project is allowlisted, then requires the pending index, the fleet declaration with a live fold-worker heartbeat and sufficient coverage, which from slice 6 is the binary's complete compile-time coverage on any database other than the production syrftest, which stays refused until gate (b) passes and the production rollout is approved (a partial-coverage binary was admitted only on the staging pilot: ProjectStatistics:Fold:AllowPartialCoverage, a positive IsStaging() and a database other than syrftest); no runtime override reaches the coverage rule. The slice-6 advance-stamp route runs the stamp advance, which refuses until ProjectStatistics:Fold:StampAdvanceAllowed is set", "reads": [ "IProjectStatisticsFlagSource flags,", "if (!flags.MaterializedFoldRequested)", "if (!flags.IsProjectAllowlisted(projectId))", "flags.MaterializedFoldRequested, flags.IsProjectAllowlisted(projectId), IsCoverageSufficient()," ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Fold/ProjectStatisticsFoldWorker.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Async point fold (FEAT-024) worker; runs only from the PM fold consumer while the deployment-pinned default-off materializedProjectStatisticsFold flag is on, and folds only allowlisted projects with fold history whose control matches this binary's protocol", "reads": [ "private readonly IProjectStatisticsFlagSource _flags;", "IProjectStatisticsFlagSource flags,", "if (!_flags.IsProjectAllowlisted(projectId)) return ProjectStatisticsFoldRunOutcome.NotAllowlisted;" ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Consumers/ProjectStatisticsFoldConsumer.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management host", "activationBoundary": "Async point fold (FEAT-024) fold and sweep consumers acknowledge without work unless the deployment-pinned default-off materializedProjectStatisticsFold flag is on, checked per delivery", "reads": [ "FeatureFlags featureFlags,", "if (!featureFlags.MaterializedProjectStatisticsFold) return;", "FeatureFlags featureFlags,", "if (!featureFlags.MaterializedProjectStatisticsFold) return;" ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Services/ProjectStatisticsFoldSchedule.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management host", "activationBoundary": "Async point fold (FEAT-024): the one-minute sweep schedule is registered only when the deployment-pinned default-off materializedProjectStatisticsFold flag is on at startup; the heartbeat renews only while it is on", "reads": [ "IServiceScopeFactory scopes, FeatureFlags featureFlags, ILogger logger)", "if (!featureFlags.MaterializedProjectStatisticsFold) return;", "FeatureFlags featureFlags,", "if (featureFlags.MaterializedProjectStatisticsFold)" ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Services/DeletionLifecycleSchedule.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management host", "activationBoundary": "Reversible deletion (S3a, ADR-024): the deletion runner's recurring schedule is registered only when the deployment-pinned default-off deletionLifecycle flag is on at startup. Per the flag's contract (env-mapping.yaml) the flag gates creating deletions; the runner's consumer does not re-check it, so already-persisted operations keep converging after the flag is turned off", "reads": [ "IServiceScopeFactory scopes, FeatureFlags featureFlags, IOptions options,", "if (!featureFlags.DeletionLifecycle) return;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Fold/ProjectScreeningFoldSave.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Async point fold (FEAT-024) slice 2 fold-path screening save, evaluated per request in memory: entered only when statistics writes, the deployment-pinned default-off materializedProjectStatisticsFold flag and the ProjectScreening family are on and the project is allowlisted, then only for a project whose durable control is in fold mode at this binary's protocol; otherwise today's path runs with no added read", "reads": [ "IProjectStatisticsFlagSource flags,", "flags.MaterializedWritesRequested", "&& flags.MaterializedFoldRequested", "&& flags.IsFamilyServingRequested(ProjectStatisticsMetricFamily.ProjectScreening)", "&& flags.IsProjectAllowlisted(projectId);", "flags.MaterializedWritesRequested", "&& AnnotationStatisticsClassifier.Families.All(flags.IsFamilyServingRequested)", "&& flags.IsProjectAllowlisted(projectId);" ] }, "src/services/api/SyRF.API.Endpoint/Services/ProjectStatisticsFoldSignalCoalescer.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Async point fold (FEAT-024) post-save signal: its publish loop starts only when the deployment-pinned default-off materializedProjectStatisticsFold flag is on at startup; a signal is enqueued only by a confirmed fold-path save", "reads": [ "FeatureFlags featureFlags,", "if (!featureFlags.MaterializedProjectStatisticsFold) return;" ] }, "src/services/api/SyRF.API.Endpoint/Services/ReviewScreeningFoldTarget.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Async point fold (FEAT-024) writer half of the fold-path screening save; reached only from ProjectScreeningFoldSave for an allowlisted project in fold mode with materializedProjectStatisticsFold on; reads ReviewEligibilityPolicy per attempt exactly as today's screening save does", "reads": [ "FeatureFlags featureFlags,", "if (!featureFlags.ReviewEligibilityPolicy && !submission.Reconciliation", "if (!featureFlags.ReviewEligibilityPolicy) return new ProjectScreeningFoldAttempt(project);", "if (featureFlags.ReviewEligibilityPolicy)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/BulkStudyUpdate/Atomic/BulkStudyUpdateAdapters.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "ADR-020 version 2 executor only (reached only for execution version 2 jobs, which the API stamps only with bulkStudyUpdateAtomicApply on); reads reviewEligibilityPolicy to apply the same row rules as version 1", "reads": [ "FeatureFlags featureFlags, ILogger logger) : IBulkStudyUpdateEffects", "public bool ReviewEligibilityPolicy => featureFlags.ReviewEligibilityPolicy;" ] }, "src/services/api/SyRF.API.Endpoint/Controllers/StudyController.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "api", "activationBoundary": "ADR-020: bulkStudyUpdateAtomicApply is read once at bulk-update job creation to stamp execution version 2; deployment-only, not runtime-overridable. Reversible deletion S3d-2 only reflowed the constructor (adding the pending-deletion query); no new flag read", "reads": [ "IDelegatedWorkAdmissions? delegatedWork = null, FeatureFlags? featureFlags = null,", "_featureFlags = featureFlags ?? new FeatureFlags();", "private readonly FeatureFlags _featureFlags;", "atomic: _featureFlags.BulkStudyUpdateAtomicApply);" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Fold/ProjectAnnotationFoldSave.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Async point fold (FEAT-024) slice 4 fold-path annotation session save, complete and delete, evaluated per request in memory: entered only when statistics writes, the deployment-pinned default-off materializedProjectStatisticsFold flag and all three annotation families are on and the project is allowlisted, then only for a project whose durable control is in fold mode at this binary's protocol; otherwise today's path runs with no added read", "reads": [ "IProjectStatisticsFlagSource flags,", "flags.MaterializedWritesRequested", "&& flags.MaterializedFoldRequested", "&& AnnotationStatisticsClassifier.Families.All(flags.IsFamilyServingRequested)", "&& flags.IsProjectAllowlisted(projectId);" ] }, "src/services/api/SyRF.API.Endpoint/Services/AnnotationFoldTargets.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "API host", "activationBoundary": "Async point fold (FEAT-024) slice 4 writer halves of the fold-path annotation save and delete; reached only after ProjectAnnotationFoldSave admitted the request (fold flag on, annotation families on, allowlisted, project in fold mode). The ReviewEligibilityPolicy and ProportionalStudyAllocation reads repeat today's per-attempt branch selection of SubmitAnnotationSessionService and RemoveSession unchanged", "reads": [ "FeatureFlags featureFlags,", "IRuntimeFeatureFlagProvider runtimeFeatureFlags,", "if (featureFlags.ReviewEligibilityPolicy)", "&& runtimeFeatureFlags.IsEnabled(RuntimeFeatureFlagKeys.ProportionalStudyAllocation);", "submission.Session.Id, keepSlottedClaim: featureFlags.ReviewEligibilityPolicy)", "if (featureFlags.ReviewEligibilityPolicy) throw new ReviewWriteRefusedException(ReviewWriteRefusal.Forbidden);", "catch (DuplicateAnnotationSessionException) when (featureFlags.ReviewEligibilityPolicy)", "if (featureFlags.ReviewEligibilityPolicy) return await SaveEligibleAsync(study, project, trackingAvailable);", "FeatureFlags featureFlags,", "if (featureFlags.ReviewEligibilityPolicy && study.ExtractionInfo.GetSessionOrDefault(deletion.SessionId) is null)", "if (featureFlags.ReviewEligibilityPolicy)", "&& (!featureFlags.ReviewEligibilityPolicy || deletion.StageOffersAnnotation(project));", "activityClaims: featureFlags.ReviewEligibilityPolicy);", "if (featureFlags.ReviewEligibilityPolicy)" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/RiskOfBiasAssessment/RobProcessingService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "Application-authority M5b: batchRiskOfBiasAtomicApply is read when a batch RoB run reaches its save; on, the save is all or nothing (RobAtomicApplier); off, results are saved exactly as before; deployment-only, not runtime-overridable", "reads": [ "private readonly FeatureFlags _featureFlags;", "FeatureFlags? featureFlags = null)", "_featureFlags = featureFlags ?? new FeatureFlags();", "if (_featureFlags.BatchRiskOfBiasAtomicApply)" ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Services/RobRunRecoveryBackgroundService.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management", "activationBoundary": "Application-authority M5b: batchRiskOfBiasAtomicApply is read once at host start; off, recovery of interrupted all-or-nothing RoB saves never runs and reads nothing; deployment-only, not runtime-overridable", "reads": [ "FeatureFlags featureFlags,", "if (!featureFlags.BatchRiskOfBiasAtomicApply) return;" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Fold/AnnotationReservationFold.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "Async point fold (FEAT-024) slice 5 reservation writers (claim, releases, eligibility admission), evaluated per request in memory: entered only when statistics writes, the deployment-pinned default-off materializedProjectStatisticsFold flag and every annotation family are on and the project is allowlisted, then only for a project whose durable control is in fold mode at this binary's protocol; otherwise today's path runs with no added read", "reads": [ "IProjectStatisticsFlagSource flags,", "flags.MaterializedWritesRequested", "&& flags.MaterializedFoldRequested", "&& AnnotationStatisticsClassifier.Families.All(flags.IsFamilyServingRequested)", "&& flags.IsProjectAllowlisted(projectId);" ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Consumers/ProjectStatisticsFoldStampAdvanceConsumer.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "project-management host", "activationBoundary": "Async point fold (FEAT-024) slice 6 stamp-advance consumer acknowledges without work unless the deployment-pinned default-off materializedProjectStatisticsFold flag is on, checked per delivery; the advance itself also refuses until ProjectStatistics:Fold:StampAdvanceAllowed records the rollout-complete gate, and at the production baseline P0 there is nothing to advance", "reads": [ "FeatureFlags featureFlags,", "if (!featureFlags.MaterializedProjectStatisticsFold) return;" ] }, "src/services/api/SyRF.API.Endpoint/Realtime/ChangeFeed/RealtimeChangeFeedRegistration.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Deployed realtimePipelineV2 read once at host start-up to register (or not) the change feed readers, their health checks and meter; no runtime override starts or stops them", "reads": [ "FeatureFlags deployedFlags, IConfiguration? configuration = null)", "if (!deployedFlags.RealtimePipelineV2)" ] }, "src/services/api/SyRF.API.Endpoint/Auth/BffAuthController.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "Per request: /api/auth/login reads bffSilentSignIn through IFeatureDecisions before forwarding prompt=none (fails closed when decisions are absent); /api/auth/refresh reads bffSlidingSession before extending the refreshed session", "reads": [ "private readonly IFeatureDecisions? _featureDecisions;", "IFeatureDecisions? featureDecisions = null)", "_featureDecisions?.Decide(SilentSignInFlagKey).Value == true;", "_featureDecisions?.Decide(BffSessionLifetime.SlidingSessionFlagKey).Value == true;" ] }, "src/services/api/SyRF.API.Endpoint/FeatureAvailability/FeatureAvailabilityEvaluator.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "Per availability request (6E.2), only while RuntimeFeatureReleases:Enabled is on and only after permission is decided: one IFeatureDecisions.DecideAll over the permitted features' registry flag keys, reported as available/unavailable/unknown. A discovery read only: it gates no route or behaviour, and decisions keep their own safe values", "reads": [ "public sealed class FeatureAvailabilityEvaluator(IFeatureDecisions decisions, IRuntimeReleaseStateReader releases,", "var decided = keys.Length == 0 ? FeatureDecisions.Empty : decisions.DecideAll(keys);" ] }, "src/services/api/SyRF.API.Endpoint/Realtime/RealtimeDeliveryRegistration.cs": { "classification": "startup-or-domain-bound", "owner": "API maintainers", "scope": "api", "activationBoundary": "Deployed realtimePipelineV2 read once at host start-up to register (or not) the registry, dispatcher and IRealtimeClients facade, and the routing marker the v1 NotificationHub takes; no runtime override switches the hub between Rx and the registry", "reads": [ "public static IServiceCollection AddRealtimeDelivery(this IServiceCollection services, FeatureFlags deployedFlags,", "if (!deployedFlags.RealtimePipelineV2)" ] }, "src/services/api/SyRF.API.Endpoint/Auth/SessionAuthenticationHandler.cs": { "classification": "existing-runtime", "owner": "API maintainers", "scope": "api", "activationBoundary": "Per request: after a BFF session authenticates, reads bffSlidingSession through IFeatureDecisions before a throttled sliding renewal; off or decisions absent renews nothing", "reads": [ "private readonly IFeatureDecisions? _featureDecisions;", "IFeatureDecisions? featureDecisions = null,", "if (_featureDecisions?.Decide(BffSessionLifetime.SlidingSessionFlagKey).Value != true)" ] }, "src/services/identity/SyRF.Identity.Endpoint/Services/ThemePreference.cs": { "classification": "startup-or-domain-bound", "owner": "Identity maintainers", "scope": "identity", "activationBoundary": "Deployment-bound: reads FeatureFlags:ThemeToggle (the Identity half of the web themeToggle, carried by the narrow identityThemeFlags Helm section) bound once at startup on IdentityHostOptions and resolved once into ThemePreferenceSettings; Identity never reads the API runtime store. Display only: gates the theme toggle, the shared theme cookie and the ?theme= hint on account pages", "reads": [ "var enabled = options.FeatureFlags.ThemeToggle;" ] }, "src/services/identity/SyRF.Identity.Endpoint/Services/SilentAuthorizationFramingMiddleware.cs": { "classification": "startup-or-domain-bound", "owner": "Identity maintainers", "scope": "identity", "activationBoundary": "Deployment-bound: reads the Identity-only FeatureFlags:IdentitySilentSignInFrame bound once at startup on IdentityHostOptions (Identity never reads the API runtime store); applies per request to GET /connect/authorize?prompt=none only", "reads": [ "if (hostOptions.FeatureFlags.IdentitySilentSignInFrame" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Lifecycle/ProjectStatisticsUnmaintainedFamilyInvalidation.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "#4284 durable trace of a statistics gate that is off: run after each fleet-membership renewal by the api and project-management hosts; reads only the deployment-pinned writes and family flags through ProjectStatisticsWriterMaintenance and stales, per allowlisted project with a control row, the families this pod does not maintain; issues nothing with an empty allowlist (production) or when the pod maintains every family, and never touches a save", "reads": [ "private readonly FeatureFlags _featureFlags;", "FeatureFlags featureFlags,", "_featureFlags = featureFlags ?? throw new ArgumentNullException(nameof(featureFlags));", "ProjectStatisticsWriterMaintenance.UnmaintainedFamilies(_featureFlags);" ] }, "src/libs/project-management/SyRF.ProjectManagement.Core/Services/ProjectStatistics/Wiring/ProjectStatisticsWriterMaintenance.cs": { "classification": "startup-or-domain-bound", "owner": "Project Management maintainers", "scope": "shared library; validate each consuming host", "activationBoundary": "#4284/#4285 pure rule for which families a pod's writers keep current, from the deployment-pinned materializedProjectStatisticsWrites and family flags via ProjectStatisticsFlagMap; no runtime enrollment, no I/O", "reads": [ "public static IReadOnlyList MaintainedFamilies(FeatureFlags featureFlags)", "ArgumentNullException.ThrowIfNull(featureFlags);", "return MaintainedFamilies(featureFlags.MaterializedProjectStatisticsWrites,", "family => ProjectStatisticsFlagMap.IsFamilyServingRequested(family, featureFlags));", "public static IReadOnlyList UnmaintainedFamilies(FeatureFlags featureFlags)", "var maintained = MaintainedFamilies(featureFlags);" ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimeFeatureFlagCatalog.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "shared policy writer and evaluator; API is the current write host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "definition => configuration.GetValue($\"FeatureFlags:{definition.ConfigurationProperty}\") ?? false," ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimeFeatureFlagModels.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "shared policy writer and evaluator; API is the current write host", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "public static bool GetEffectiveValue(string key, bool candidateValue, FeatureFlags backendFlags) => key switch", "SignalRActiveKey when backendFlags.ActiveReviewerTrackingEnabled => backendFlags.SignalRActive,", "public static void EnsureValidMutation(string key, bool candidateValue, FeatureFlags backendFlags)", "if (key == SignalRActiveKey && backendFlags.ActiveReviewerTrackingEnabled &&", "candidateValue != backendFlags.SignalRActive)", "private static bool IsInvalidBulkPdfEnable(string key, FeatureFlags backendFlags) =>", "key == BulkPdfUploadKey && !backendFlags.DeletionLifecycle;" ] }, "src/services/api/SyRF.API.RuntimeAdministration/RuntimeFeatureFlags/RuntimeFeatureFlagStore.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "API-only legacy policy store (SyRF.API.RuntimeAdministration); the shared evaluation it uses is RuntimeFeatureFlagEffectiveValues", "activationBoundary": "Preserve current lifecycle/domain contract; no shared runtime enrollment without operation audit", "reads": [ "private readonly FeatureFlags _backendFlags;", "FeatureFlags backendFlags, TimeProvider timeProvider)", "FeatureFlags backendFlags, TimeProvider timeProvider,", "IReadOnlyDictionary staticValues, FeatureFlags backendFlags)", "FeatureFlags backendFlags)", "FeatureFlags backendFlags,", "FeatureFlags backendFlags," ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimeFeatureFlagEffectiveValues.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "shared evaluator: the API legacy store and every Shared authority host", "activationBoundary": "Pure effective-value computation (overrides, deployed values, dependencies); never enables, mutates or admits a flag", "reads": [ "FeatureFlags backendFlags,", "internal static bool ReadDeploymentDependency(string key, FeatureFlags backendFlags) => key switch", "\"deletionLifecycle\" => backendFlags.DeletionLifecycle," ] }, "src/services/api/SyRF.API.RuntimeAdministration/RuntimeFeatureFlags/RuntimePolicyLineageImport.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "API image, explicit operator-only lineage command", "activationBoundary": "Reviewed preview/apply only; verified binding, complete reviewed baseline, stopped legacy writers and migration-owned audit indexes; never startup or feature activation", "reads": [ "var legacy = SharedRuntimeFeatureFlagReader.Parse(source, DateTimeOffset.UtcNow);", "var legacy = SharedRuntimeFeatureFlagReader.Parse(current, DateTimeOffset.UtcNow);" ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/MongoRuntimePolicyAuthoritySource.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "API and Project Management optional authority observation", "activationBoundary": "Read-only receipt and binding validation; Legacy default; no domain consumer enrollment; immutable capture and fail-closed freshness", "reads": [ "_ = SharedRuntimeFeatureFlagReader.Parse(document, DateTimeOffset.UtcNow);" ] }, "src/services/api/SyRF.API.RuntimeAdministration/RuntimeFeatureFlags/RuntimePolicyMutationStore.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "API authority mutation primitive", "activationBoundary": "Explicit non-production binding; exact expected identity; atomic receipt and preserved deployment constraints; no endpoint or consumer enrollment", "reads": [ "IConfiguration configuration, FeatureFlags deployedFlags, TimeProvider clock)" ] }, "src/services/api/SyRF.API.RuntimeAdministration/RuntimeFeatureReleases/RuntimeReleaseReconcilerService.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "API release confirmation reconciler (6D.2); passes the deployed flags to the mutation store it constructs", "activationBoundary": "Shared-mode API writer only, absent in Legacy; converges releases an operator already applied; leased per release; MongoDB-time decisions; fails closed without release indexes", "reads": [ "FeatureFlags flags, TimeProvider clock, ILogger logger)" ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimePolicyAuthorityEvaluator.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "API and Project Management reviewed authority evaluation", "activationBoundary": "Audited host contract; bounded immutable capture; deployment constraints; explicit non-production Shared enrollment, Shadow inspection only", "reads": [ "RuntimePolicyAuthorityOptions options, IConfiguration configuration, FeatureFlags deployedFlags)", "IReadOnlyDictionary deployed, FeatureFlags deployedFlags)", "FeatureFlags deployedFlags) => RuntimeFeatureFlagEffectiveValues.BuildEffectiveValues(new MongoDB.Bson.BsonDocument()," ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimeTargetingEvaluator.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "Deployment part of a targeted decision (6F.2, #4469), shared by authority evaluation and the targeting preview", "activationBoundary": "Pure function of deployed values and deployed FeatureFlags passed by the caller: a pin that fixes a key's value decides as the context-free values do; otherwise the deployment can only keep the key off. Reads no store and decides no Global key", "reads": [ "internal static (bool Fixed, bool Allows) Effect(string key, IReadOnlyDictionary deployed, FeatureFlags deployedFlags)", "bool switchOn, IReadOnlyDictionary contextFree, IReadOnlyDictionary deployed, FeatureFlags deployedFlags)" ] }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Services/AuthorityProjectStatisticsFlagSource.cs": { "classification": "shared-reader", "owner": "Statistics maintainers", "scope": "PM bound authority serving and existing three selectors", "activationBoundary": "Explicit non-production Shared mode; audited 30-second authority; first failure refuses serving/selectors; deployment maintenance and durable domain gates remain", "reads": [ "public sealed class AuthorityProjectStatisticsFlagSource(FeatureFlags flags, ProjectStatisticsAllowlist allowlist,", "IFeatureDecisions decisions) : IProjectStatisticsFlagSource", "&& decisions.Decide(RuntimeFeatureFlagKeys.MaterializedProjectStatisticsServing).Value;", "public bool PagesConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.PagesKey).Value;", "public bool StageOverviewConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.StageOverviewKey).Value;", "public bool SignalRConsumerEnabled => decisions.Decide(ProjectStatisticsFlagMap.SignalRKey).Value;" ] }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/RuntimePolicyEmergencyStop.cs": { "classification": "control-plane", "owner": "API maintainers", "scope": "Bound emergency-stop transport", "activationBoundary": "EmergencyStop capability; explicit non-production Shared API mode; verified binding and full identity; no fleet Active claim", "reads": [ "IConfiguration configuration, FeatureFlags flags, TimeProvider clock, ILogger logger)" ] }, "src/services/api/SyRF.API.RuntimeAdministration/RuntimeFeatureFlags/RuntimePolicyPreview.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "Bound preview and transactional commit revalidation (policy changes and, from 6F.2, targeting replacements)", "activationBoundary": "Read-only preview; full identity, request, deployment inputs and constraint guard bound in digest; no fleet readiness claim. The deployment inputs are captured once per preview (DeploymentCapture) and shared by the policy and targeting digests", "reads": [ "private sealed record DeploymentCapture(FeatureFlags Backend, FrozenDictionary Deployed)", "public BsonDocument BackendValues() => new(typeof(FeatureFlags).GetProperties().Where(property => property.PropertyType == typeof(bool))", "private DeploymentCapture CaptureDeployment() => new(JsonSerializer.Deserialize(JsonSerializer.Serialize(deployedFlags))!," ] }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/RuntimePolicyAdministration.cs": { "classification": "control-plane", "owner": "API maintainers", "scope": "Bound policy preview and commit transport", "activationBoundary": "Change policy capability; explicit non-production Shared API mode; verified binding, identity and preview digest; emergency stop uses its separate capability", "reads": [ "IConfiguration configuration, FeatureFlags flags, TimeProvider clock, ILogger logger)" ] }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/RuntimeReleaseOutboxDispatcherService.cs": { "classification": "control-plane", "owner": "API maintainers", "scope": "Release outbox dispatch host (6D.3)", "activationBoundary": "Registered only in Shared API authority mode; RuntimeFeatureReleases:OutboxDispatch:Enabled (default false) read every pass; verified binding; deployed flags only feed the guard's capability check, never enable or mutate a flag", "reads": [ "IConfiguration configuration, FeatureFlags flags, TimeProvider clock, IEnumerable handlers," ] }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/RuntimeDeploymentCoordinator.cs": { "classification": "control-plane", "owner": "API maintainers", "scope": "Bound verified deployment coordinator transport", "activationBoundary": "Dedicated machine coordinator scope; default-off deployment gate; explicit non-production Shared API mode and exact binding; verified completion required for normal release; no policy editing or break-glass", "reads": [ "RuntimePolicyAuthorityOptions authorityOptions, IConfiguration configuration, FeatureFlags flags," ] }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/RuntimeDeploymentBreakGlass.cs": { "classification": "control-plane", "owner": "API maintainers", "scope": "Bound administrator deployment constraint recovery", "activationBoundary": "Separate administrator capability; unimpersonated human; explicit non-production Shared API mode and exact binding; audited release only", "reads": [ "IConfiguration configuration, FeatureFlags flags, TimeProvider clock, ILogger logger)" ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimeReportCompleteness.cs": { "classification": "control-plane", "owner": "Shared platform maintainers", "scope": "Compatibility report completeness and RT-15 legacy parity (API report host)", "activationBoundary": "Read-only evidence; deployed values only compared with the runtime decision for parity; never enables, mutates or admits a flag", "reads": [ "IReadOnlyDictionary Deployed, FeatureFlags DeployedFlags)", "RuntimeFeatureFlagCatalog.All.ToDictionary(flag => flag.Key, _ => false, StringComparer.Ordinal), new FeatureFlags());", "public static RuntimeReportSettings FromConfiguration(IConfiguration configuration, FeatureFlags deployedFlags) =>" ] }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/RuntimeEnvironmentReports.cs": { "classification": "control-plane", "owner": "API maintainers", "scope": "Environment compatibility report collection transport", "activationBoundary": "Read-only evidence collection behind the report client; deployed flags feed legacy parity only", "reads": [ "TimeProvider clock, ILogger logger, IConfiguration configuration, FeatureFlags deployedFlags)" ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/FeatureDecisions.cs": { "classification": "shared-reader", "owner": "Shared platform maintainers", "scope": "shared library; API and Project Management", "activationBoundary": "IFeatureDecisions (R3c): the one interface callers read runtime flags through; synchronous, catalog-owned safe value, DecideAll from one capture per source", "reads": [ "public interface IFeatureDecisions" ] }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimeFeatureDecisions.cs": { "classification": "shared-reader", "owner": "Shared platform maintainers", "scope": "shared library; API and Project Management", "activationBoundary": "Routes each key to the path the host's modes select (enrolled shared-reader keys, Shared-mode contract keys through the bound authority, otherwise the host's compatibility values); one lazy capture per source per call; parity-tested against the replaced call sites", "reads": [ "public sealed class RuntimeFeatureDecisions : IFeatureDecisions", "private readonly SharedRuntimeFeatureFlagReader? _sharedReader;", "SharedRuntimeFeatureFlagOptions? sharedOptions = null, SharedRuntimeFeatureFlagReader? sharedReader = null)", "var value = SharedRuntimeFeatureFlagReader.Evaluate(observed, key, _sharedOptions!.DeployedDefault(key, _configured));", "SharedRuntimeFeatureFlagReader.AuthorityPreservedState => new(key, value ?? SafeValue(key),", "private static readonly FrozenDictionary> Properties = RuntimeFeatureFlagCatalog.All", ".Select(definition => (definition.Key, Property: typeof(FeatureFlags).GetProperty(definition.ConfigurationProperty,", "item => (Func)Delegate.CreateDelegate(typeof(Func), item.Property!.GetMethod!),", "private readonly FeatureFlags _flags;", "public ConfiguredFeatureFlagValues(IConfiguration configuration, FeatureFlags flags)", "services.TryAddSingleton(provider => new RuntimeFeatureDecisions(", "provider.GetService()));" ] } }, "legacySeamAllowList": { "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/MongoRuntimePolicyAuthoritySource.cs": { "kind": "control-plane", "reason": "Parses the legacy document (SharedRuntimeFeatureFlagReader.Parse) to classify it; decides no flag" }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimeFeatureDecisions.cs": { "kind": "implementation", "reason": "The IFeatureDecisions implementation: delegates to the shared reader and the authority evaluator" }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimePolicyAuthorityEvaluator.cs": { "kind": "implementation", "reason": "The authority path IFeatureDecisions delegates to; also serves status and administration" }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/RuntimePolicyAuthorityRegistration.cs": { "kind": "implementation", "reason": "Registers the authority evaluator" }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/SharedRuntimeFeatureFlagReader.cs": { "kind": "implementation", "reason": "The legacy-format shared reader path IFeatureDecisions delegates to" }, "src/libs/mongo/SyRF.Mongo.Common/RuntimeFeatureFlags/SharedRuntimeFeatureFlagRegistration.cs": { "kind": "implementation", "reason": "Registers the shared reader and its diagnostic health check" }, "src/services/api/SyRF.API.Endpoint/Controllers/ProjectStatisticsHistoryController.cs": { "kind": "pending-migration", "reason": "Reads statistics switches from FeatureFlags as the runtime provider mutates it; IFeatureDecisions would decide the contract key materializedProjectStatisticsPages from the bounded authority in Shared mode (different staleness semantics), so migration needs its own review" }, "src/services/api/SyRF.API.Endpoint/Controllers/ReviewController.cs": { "kind": "pending-migration", "reason": "IRuntimeFeatureFlagProvider.IsEnabled for proportionalStudyAllocation and maxInProgressSessions; Decide(key).Value is identical (compatibility values), follow-up migrates it" }, "src/services/api/SyRF.API.Endpoint/Controllers/ReviewerAnnotationHistoryController.cs": { "kind": "pending-migration", "reason": "As ProjectStatisticsHistoryController: FeatureFlags mutated by the runtime provider; the pages contract key would change staleness semantics" }, "src/services/api/SyRF.API.Endpoint/Controllers/ReviewerScreeningHistoryController.cs": { "kind": "pending-migration", "reason": "As ProjectStatisticsHistoryController: FeatureFlags mutated by the runtime provider; the pages contract key would change staleness semantics" }, "src/services/api/SyRF.API.Endpoint/Controllers/RuntimeFeatureFlagsController.cs": { "kind": "control-plane", "reason": "Status and diagnostics endpoints report the shared reader's observation" }, "src/services/api/SyRF.API.Endpoint/Controllers/StageAllocationReadController.cs": { "kind": "pending-migration", "reason": "IRuntimeFeatureFlagProvider.IsEnabled for proportionalStudyAllocation and maxInProgressSessions; follow-up migration" }, "src/services/api/SyRF.API.Endpoint/Controllers/StageStatisticsHistoryController.cs": { "kind": "pending-migration", "reason": "As ProjectStatisticsHistoryController: FeatureFlags mutated by the runtime provider; the pages contract key would change staleness semantics" }, "src/services/api/SyRF.API.Endpoint/Controllers/StageWorkloadSharesController.cs": { "kind": "pending-migration", "reason": "IRuntimeFeatureFlagProvider.IsEnabled for proportionalStudyAllocation; follow-up migration" }, "src/services/api/SyRF.API.Endpoint/Program.cs": { "kind": "implementation", "reason": "Registers the runtime provider (IFeatureDecisions' compatibility values) and its IRuntimeFeatureFlagProvider alias for the pending migrations below" }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/AuthorityRuntimeFeatureFlagReadStore.cs": { "kind": "control-plane", "reason": "Builds the browser compatibility snapshot from the evaluator in Shared mode" }, "src/services/api/SyRF.API.Endpoint/RuntimeFeatureFlags/RuntimeFeatureFlagProvider.cs": { "kind": "implementation", "reason": "The API runtime provider: IFeatureDecisions' compatibility values; IsEnabled remains only for the pending migrations below" }, "src/services/api/SyRF.API.Endpoint/Services/AnnotationFoldTargets.cs": { "kind": "pending-migration", "reason": "IRuntimeFeatureFlagProvider.IsEnabled for proportionalStudyAllocation; follow-up migration" }, "src/services/api/SyRF.API.Endpoint/Services/RuntimeProjectStatisticsFlagSource.cs": { "kind": "deployed-configuration", "reason": "Reads only ActiveReviewerTrackingAvailable from FeatureFlags, which is deployed configuration; every runtime switch reads IFeatureDecisions" }, "src/services/api/SyRF.API.Endpoint/Services/SubmitAnnotationSessionService.cs": { "kind": "pending-migration", "reason": "IRuntimeFeatureFlagProvider.IsEnabled for proportionalStudyAllocation; follow-up migration" }, "src/services/api/SyRF.API.RuntimeAdministration/RuntimeFeatureFlags/RuntimeEnvironmentReportStore.cs": { "kind": "control-plane", "reason": "Compatibility reports reuse the evaluator's effective-value logic for parity" }, "src/services/api/SyRF.API.RuntimeAdministration/RuntimeFeatureFlags/RuntimePolicyLineageImport.cs": { "kind": "control-plane", "reason": "Lineage import parses the legacy document (SharedRuntimeFeatureFlagReader.Parse)" }, "src/services/api/SyRF.API.RuntimeAdministration/RuntimeFeatureFlags/RuntimeReleaseOutboxStore.cs": { "kind": "control-plane", "reason": "CapabilityHolds reuses the evaluator's effective-value logic (EffectiveValues and StoppedKeys) to decide whether a release's capability holds in a given policy snapshot: for the dispatcher's guard at each audited revision since Apply (RT-23), and for release confirmation and stop and restore recording (RuntimeReleaseReconciliation.cs, RT-21, RT-24); it decides no flag for this process" }, "src/services/project-management/SyRF.ProjectManagement.Endpoint/Controllers/RuntimeFeatureFlagReaderController.cs": { "kind": "control-plane", "reason": "Diagnostics endpoint reports the shared reader's observation" } } }