modules: Approvals + FileExchange reach full composition — EF stores + template flags

CHANGELOG.md

@@ -18,9 +18,11 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · Versioning:
   integration events. 7-test planted-fault rig; `features.fileExchange` +
   `goldpath add feature fileexchange`.
 
-  Both cores ship with in-memory stores behind seams (`IGoldpathApprovalStore`,
-  `IGoldpathFileLedger`); database-backed stores, template flags and console federation
-  are tracked in the RFCs' open DoD rows (T21/T22).
+  Both modules ship database-backed stores on the app's own DbContext
+  (`AddGoldpathApprovalModel` / `AddGoldpathFileExchangeModel`, in-memory fallbacks behind
+  the same seams) and full composition: manifest keys, `goldpath add feature`, and
+  `dotnet new goldpath-solution --features approvals/fileexchange`. Console federation and
+  the adopter proofs are tracked in the RFCs' open DoD rows (T21/T22).
 
 ## [0.1.0-preview.6] - 2026-08-03
 

docs/rfc/README.md

@@ -45,6 +45,6 @@ All "implemented" modules are published on nuget.org at `0.1.0-preview.6` (the c
 | [spec-engine-v1](spec-engine-v1.md) | specdrift (separate repo) | implemented — 0.4.2 published (NuGet tool + MCP + Docker + Action) |
 | [qorpe-ui](qorpe-ui.md) | @qorpe/ui — the family UI kit extraction (platform-sdk D5) | **implemented** (step 6.0, 2026-08-07): the kit lives in [qorpe/ui](https://github.com/qorpe/ui), publishes to npm via OIDC trusted publishing, and BOTH consumers run on the published package — `ui/kit` is deleted from this repo |
 | [qorpe-sync](qorpe-sync.md) | qorpe.sync (separate private repo) — the migration & co-existence product module (ADR-0012's own named example): CDC capture, ordered replayable stream, adapter-based versioned mapping, event-id reconciliation composing db-compare | **accepted** (owner, 2026-08-18) — v0 scope is engagement-shaped (§5.1 by-product rule); build scheduled, two-store rig first; the second-product-repo ordering is an owner decision recorded in RFC D5 |
-| [goldpath-approvals](goldpath-approvals.md) | Goldpath.Approvals — human approval workflows: maker-checker, four-eyes, amount-laddered authority, delegation, escalation, worklist; definitions as versioned data | **accepted** (owner, 2026-08-18) — build started same day by owner decision; core + 17 tests + manifest/CLI wiring landed; console federation, DB store and the adopter proof stay open (T21) |
-| [goldpath-fileexchange](goldpath-fileexchange.md) | Goldpath.FileExchange — file-based integration rails as a unit: scheduled pick-up/drop, format contracts, idempotent `(file,line)` ingestion, quarantine, reprocessing, archival, outbound | **accepted** (owner, 2026-08-18) — build started same day by owner decision; core + 7-test planted-fault rig + manifest/CLI wiring landed; transports, console federation, DB ledger and the adopter proof stay open (T22) |
+| [goldpath-approvals](goldpath-approvals.md) | Goldpath.Approvals — human approval workflows: maker-checker, four-eyes, amount-laddered authority, delegation, escalation, worklist; definitions as versioned data | **accepted** (owner, 2026-08-18) — build started same day by owner decision; core + 20 tests + manifest/CLI/template wiring + EF store landed; console federation and the adopter proof stay open (T21) |
+| [goldpath-fileexchange](goldpath-fileexchange.md) | Goldpath.FileExchange — file-based integration rails as a unit: scheduled pick-up/drop, format contracts, idempotent `(file,line)` ingestion, quarantine, reprocessing, archival, outbound | **accepted** (owner, 2026-08-18) — build started same day by owner decision; core + 9 tests (planted-fault rig + EF ledger) + manifest/CLI/template wiring landed; transports, console federation and the adopter proof stay open (T22) |
 | [specanchor-composition](specanchor-composition.md) | specanchor (separate repo) — the transformation package's deterministic core, composed per foundation §9/§5.1 | **ACCEPTED** (2026-08-16, #165) — the toolchain is real ([qorpe/specanchor](https://github.com/qorpe/specanchor), Apache-2.0; 74 tests, mutation 94.8%, first skill eval 7/7); the composition proof it owes is `open-threads.md` T20 (the rehearsal) |

docs/rfc/goldpath-approvals.md

@@ -84,11 +84,16 @@ ladder's own deadline.
       (17 tests: rung boundaries inclusive, four-eyes, wrong-role refusal, double-decide,
       escalation resets the rung clock, top-rung expiry, delegation depth-one + expiry,
       worklist ordering, trail completeness — `tests/Goldpath.Approvals.Tests`).
-- [x] `features.approvals` manifest key + `goldpath add feature approvals` CLI recipe wired
-      (template flag lands with the module's template pass).
+- [x] `features.approvals` manifest key + `goldpath add feature approvals` CLI recipe wired.
+- [x] Template flag: `dotnet new goldpath-solution --features approvals` generates the
+      manifest line, package reference, EF-store registration and model call — proven by
+      generating and BUILDING an app with the flag against the train's packages.
+- [x] Database-backed store: `GoldpathEfApprovalStore<TContext>` on the app's own DbContext
+      (`modelBuilder.AddGoldpathApprovalModel()`) — requests, trails (JSON column) and
+      delegations survive restarts; proven on real SQLite storage (3 tests: restarted
+      engine sees the same worklist, trail round-trips, delegations persist and expire).
 - [ ] Admin surface federates in the family console against a real app.
 - [x] Runbook ships (`packages/Goldpath.Approvals/ops/approvals.md`); dashboard JSON open.
-- [ ] Database-backed `IGoldpathApprovalStore` (the in-memory store is single-node).
 - [ ] The adopter proof runs (§7 last row) — the row that actually closes T21.
 
 ### Decisions

docs/rfc/goldpath-fileexchange.md

@@ -88,10 +88,18 @@ window — the incident file rails actually have.
       truncated file rejected whole, reprocess-after-fix retries only the quarantined row —
       `tests/Goldpath.FileExchange.Tests`).
 - [x] `features.fileExchange` manifest key + `goldpath add feature fileexchange` CLI recipe
-      wired (template flag lands with the module's template pass).
+      wired.
+- [x] Template flag: `dotnet new goldpath-solution --features fileexchange` generates the
+      manifest line, package reference, EF-ledger registration and model call — proven by
+      generating and BUILDING an app with the flag against the train's packages.
+- [x] Database-backed ledger: `GoldpathEfFileLedger<TContext>` on the app's own DbContext
+      (`modelBuilder.AddGoldpathFileExchangeModel()`) — processed keys, quarantine and
+      archive marks survive restarts; proven on real SQLite storage (2 tests: zero
+      duplicates across a restart, quarantine persists with its reason and clears on
+      reprocess).
 - [ ] Admin surface federates in the family console against a real app.
 - [x] Runbook ships (`packages/Goldpath.FileExchange/ops/fileexchange.md`); dashboard JSON open.
-- [ ] Database-backed `IGoldpathFileLedger` + transport adapters (SFTP/share/object store).
+- [ ] Transport adapters (SFTP/share/object store) — composed, per RFC §1.
 - [ ] The adopter proof runs (§7 last row) — the row that actually closes T22.
 
 ### Decisions

docs/strategy/open-threads.md

@@ -24,8 +24,8 @@ pending forever.
 | T17 | **Per-package ops packs for the three floor packages** (Messaging, Data, ApiDefaults) | Their RFC §6 sections describe dashboards (consumer lag, outbox backlog, EF query duration, deprecated-version traffic) that are NOT packaged — the signals reach OTel through ServiceDefaults, whose ops pack is what an adopter gets. Found by an audit 2026-08-09; the RFC sections now say so | the first adopter who asks for a floor dashboard, OR the first incident whose triage needed one | the pack ships with the same shape the five module packs have (runbook + Grafana JSON), and the RFC §6 correction note is removed |
 | T18 | **The MassTransit 8.x exit** — the watch that keeps option A honest | [goldpath-messaging-exit](../rfc/goldpath-messaging-exit.md) decided **A: stay pinned on 8.5.10** (Apache-2.0), because a move is a MAJOR version, not an internal swap — measured, not assumed. The publish seam already shipped (`IIntegrationEventPublisher` + GP0404), so a generated app's COMMAND HANDLERS no longer name the library; its CONSUMERS still do, deliberately | **any one of four**: an unpatched CVE in the 8.x line · the vendor's v8 maintenance window closing (~end 2026 per their own statements) · an adopter's licensing constraint · a customer requiring a bus we do not compose | the five proofs in that RFC §7 — outbox atomicity on the new transport · tenant+correlation headers still propagate (H4) · GP0401-0403 still mean something · the golden-manifest matrix green on every broker-bearing shape · CorPay migrated with a written guide an adopter could actually follow |
 | T20 | **The specanchor rehearsal** — the transformation composition's proof ([specanchor-composition](../rfc/specanchor-composition.md)) | specanchor's own chain is proven on its rig (74 tests, mutation 94.8%, first skill eval 7/7), but the COMPOSITION — §9's method running on specanchor's machinery with Goldpath as target — has never run end to end; per the RFC's D4/D5, no profile code is written before it does | the fake-legacy → Goldpath migration rehearsal is scheduled (before the factoring engagement's PoC) | Discovery Zero → dual-track slices → approved specs → `goldpath new` target → parity with Mockifyr equalization → db-compare reconciliation → cutover evidence bundle, with the Discovery Zero playbook written from the rehearsal's diary; only then do ai-sdlc-status's `reverse-engineer`/`differential-test` rows leave NOT BUILT |
-| T21 | **`Goldpath.Approvals`** — human approval workflows: maker-checker, four-eyes, amount-laddered authority, delegation, escalation, and the task worklist/inbox that feeds them | A Ring B candidate surfaced by the factoring-class engagement: SIX of its twelve common processes run approvals over e-mail today, and the amount ladder (expert → deputy → manager → GM) is domain-agnostic across banking/insurance/telco. Distinct from the T19 saga non-goal — these are HUMAN approval chains, not process orchestration. The RFC is ACCEPTED and the build STARTED 2026-08-18 by explicit owner decision (the trigger pulled early — recorded in the RFC header): `Goldpath.Approvals` core landed with 17 deterministic tests, manifest key + CLI recipe wired. Open before the thread closes: template flag, database-backed store, console federation, dashboard JSON — and the adopter proof below | The engagement's implementation phase needs its first systematized approval flow (the §5.1 by-product rule: born inside a real deliverable, never as a third front) | The RFC through the eight sections; the four Ring B criteria confirmed in review; one real amount-laddered approval flow from the adopter runs end to end on the module, with its audit trail |
-| T22 | **`Goldpath.FileExchange`** — file-based integration rails: scheduled pick-up/drop, validation, idempotent ingestion, reprocessing, archival | Banking file rails (nightly registry FTP batches, 2×/day bank status files, MT940, CSV extraction contracts) recur in THREE of the engagement's common processes; Jobs+Bulk cover pieces but not the rail as a unit. The RFC is ACCEPTED and the build STARTED 2026-08-18 by explicit owner decision (the trigger pulled early — recorded in the RFC header): `Goldpath.FileExchange` core landed with the 7-test planted-fault rig, manifest key + CLI recipe wired. Open before the thread closes: template flag, database-backed ledger, transport adapters, console federation, dashboard JSON — and the adopter proof below | The first adopter integration that is file-based and bidirectional enters an implementation backlog | One real file rail runs with replay + idempotency + failure reprocessing + its ops runbook, per the module ops-pack shape |
+| T21 | **`Goldpath.Approvals`** — human approval workflows: maker-checker, four-eyes, amount-laddered authority, delegation, escalation, and the task worklist/inbox that feeds them | A Ring B candidate surfaced by the factoring-class engagement: SIX of its twelve common processes run approvals over e-mail today, and the amount ladder (expert → deputy → manager → GM) is domain-agnostic across banking/insurance/telco. Distinct from the T19 saga non-goal — these are HUMAN approval chains, not process orchestration. The RFC is ACCEPTED and the build STARTED 2026-08-18 by explicit owner decision (the trigger pulled early — recorded in the RFC header): `Goldpath.Approvals` core landed with 17 deterministic tests, manifest key + CLI recipe wired. 2026-08-18 (later the same day) the database-backed store landed (EF on the app's own DbContext, proven on real storage) and the template flag shipped (a generated app with the flag BUILDS against the train). Open before the thread closes: console federation, dashboard JSON — and the adopter proof below | The engagement's implementation phase needs its first systematized approval flow (the §5.1 by-product rule: born inside a real deliverable, never as a third front) | The RFC through the eight sections; the four Ring B criteria confirmed in review; one real amount-laddered approval flow from the adopter runs end to end on the module, with its audit trail |
+| T22 | **`Goldpath.FileExchange`** — file-based integration rails: scheduled pick-up/drop, validation, idempotent ingestion, reprocessing, archival | Banking file rails (nightly registry FTP batches, 2×/day bank status files, MT940, CSV extraction contracts) recur in THREE of the engagement's common processes; Jobs+Bulk cover pieces but not the rail as a unit. The RFC is ACCEPTED and the build STARTED 2026-08-18 by explicit owner decision (the trigger pulled early — recorded in the RFC header): `Goldpath.FileExchange` core landed with the 7-test planted-fault rig, manifest key + CLI recipe wired. 2026-08-18 (later the same day) the database-backed ledger landed (EF on the app's own DbContext, proven on real storage) and the template flag shipped (a generated app with the flag BUILDS against the train). Open before the thread closes: transport adapters, console federation, dashboard JSON — and the adopter proof below | The first adopter integration that is file-based and bidirectional enters an implementation backlog | One real file rail runs with replay + idempotency + failure reprocessing + its ops runbook, per the module ops-pack shape |
 | T23 | **Factoring industry pack + vertical template** — glossary seeds (with false-friend notes), edge-case catalogs, regulatory constraint register skeleton, accounting event dictionary patterns, DMN pricing patterns, integration blueprints (spec + Mockifyr stubs), and a `goldpath new` template pre-setting the domain's bounded-context skeleton | Foundation §6.3's industry-pack layer is the sanctioned home for domain knowledge — the core stays domain-free. The pack is DISTILLED from engagement work, never built up front; the leakage red line holds: public/regulatory knowledge + generalized patterns only, client IP contractually excluded | The engagement's first phase proves the patterns in production AND a second factoring-class prospect appears | The template stands up the domain skeleton via `goldpath new`; the pack's seeds pass the same eval discipline as skills; zero client-confidential content, confirmed by written IP review |
 
 ## Closed threads

packages/Goldpath.Approvals/Goldpath.Approvals.csproj

@@ -14,6 +14,10 @@
   </ItemGroup>
 
   <ItemGroup>
+    <!-- net10 pins Relational centrally; on net8 the reference stays transitive
+         (Goldpath.Messaging -> MassTransit.EntityFrameworkCore -> Relational 9.0.1),
+         because a direct 8.0.x reference would be a downgrade (NU1605). -->
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Condition="'$(TargetFramework)' == 'net10.0'" />
     <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" />
   </ItemGroup>