Pillar 7 · Structure & discipline (the foundation)

The ground the other six pillars stand on. Code shape: Go packaged by domain (internal/<domain>/{entity,usecase,repo,db,ops,facade} — the by-layer domain → usecases → routes god-packages were dissolved 2026-07-27, see backend-domain-modules) with sqlc (a db/ per domain), a single canonical schema.sql whose migrations the backend applies itself at boot (bd45353f4, 2026-08-31, backend/internal/infra/pgstore/migrate.go), Next.js as a thin shell, apierr's one error envelope with log/client separation, bwrap sandboxes with no network, the builder (microsite vite runner, no docker.sock), PDF via gotenberg + printsess, and three test estates (e2e Playwright, eval-harness, mock-stack fake upstreams). Discipline: mechanical guardrails (boundary lints, check-no-mock) hold the α≈0 tier; the judgment audit holds what lint can't mechanize.

Status: stable.

Package dependencies (allowed and forbidden edges)

flowchart TB
  RT["routes (cyclo ≤ 3)"] --> DISP["routes/dispatcher (one op registry)"]
  DISP --> FAC["internal/<domain>/facade (the only legal import)"]
  FAC --> UC["<domain>/usecase + ops"]
  UC --> DOM["<domain>/entity (pure)"]
  PG["<domain>/repo + db (sqlc)"] -- implements --> DOM
  UC --> PG
  AC["backend/agentcore (OUTSIDE internal/)"] -- bridges --> FAC
  EH["eval-harness (separate go.mod)"] --> AC
  EH x--x INT["backend/internal/*"]
  MSRV["mcp-servers/* (own go.mods)"] x--x INT

The two forbidden edges are the load-bearing ones: eval-harness and the mcp-servers may touch ONLY the public seams (agentcore, the MCP wire protocol) — re-exporting internal/ types counts as a dependency and is banned (agent-as-injectable-driver); check-no-mock keeps fixtures out of backend.

Children

• structure-diagram-coverage — diagram-coverage ledger.
• ephemeral-over-stateful — derive or append; don't keep mutable state.
• display-error-surfacing — the apierr envelope; 401/409/toast branching.
• sandbox-js-hardening — bwrap, --network=none, whitelists.
• builder-claim-skip-locked — build-queue claiming.
• mechanical-guardrails — the lint tier of verification: 45 guards + 10 self-tests (55 check-* entries under infra/scripts/, counted 2026-09-07) in five families.
• convergence-inbound-and-outbound — the two convergence points (dispatcher / hostdesk), a kernel that holds no capability and cannot unseal, one scheduler, axes that declare in data.
• one-source-per-ui-primitive — twelve gates so a second dropdown / scrim / time format has nowhere to live.
• a-gate-that-cannot-go-red — ten guards whose only job is to attack the other forty-five.
• judgment-audit — the audit-guide process + 10 dimensions.