Current Repository Responsibility Map

• Classification: OBSERVED-FACT / LOCAL UNCOMMITTED P1-002 INPUT
• Authority: none; current owners and Runtime source override this dated map
• Task: P1-002
• Artifact owner: retained P1-002 observation and downstream move-gate input
• Audience: user, Product/Architecture reviewers, developers and AI agents
• Remote Runtime/tree basis: origin/qa@cd26f23f45c2f6378963fb574cccf98807fb7b3c; ca34ce649 added 13 root Node contract tests and changed existing Runtime/UI/test files without changing repository responsibility boundaries
• Local decision basis: uncommitted Reset Revision 27; remote Reset remains Revision 10 until an approved commit
• Environment: current Mac checkout, read-only source/filesystem inspection
• Downstream consumers: P1-002 target review, P5 module/repository inventory, P7 frontend inventory and P8 consumer-safe document work
• Observed: 2026-07-31
• Runtime/DB/provider/service/Production mutation: none
• Retention/removal: retain this dated map until P5/P7/P8 owners revalidate or absorb its unique observations; remove only after downstream references and unresolved move-gate evidence are disposed

1. Scope and result

This map classifies current source, entry points, dynamic loaders, build units, tests, scripts, documentation consumers, vendor/reference material and local private/generated state.

P1-002 deliverable state:

Deliverable	State
current repository responsibility map	REVIEWED P1-002 INPUT
target layout and folder creation rules	USER-APPROVED; RP1~RP6 A integrated into canonical owners
current-to-target move map	USER-APPROVED; RM1 A, no move executed
reference module and staged wave plan	USER-APPROVED; corrected SW1, no conversion executed

2. Current tracked shape

The largest tracked path groups are:

Path	Tracked paths	Interpretation
app/	31,918	first-party Runtime plus a very large mixed utility/vendor tree
public/	2,291	direct HTTP endpoints, authored browser source, vendor/compatibility and declared generated assets
scripts/	1,182	build, import, migration, DB, operation, repair, analysis and verification roles
docs/	981	Product, plan, process, manual, research, evidence and Runtime-consumed documentation
reference/	661	historical YP/MK source copies
frontend/	118	server-rendered pages, global partials and authored style inputs
tests/	116	PHP unit/integration suites and root Node contract checks

The current tree has no tracked symlink or submodule. Counts describe Git paths, not active ownership, Runtime reachability or product value.

The counts were refreshed at cd26f23f4; route/module manifest totals were rechecked because the intervening commit did not change their source paths. HEAD has 37,383 tracked paths. The working tree has the two approved P1-001 document deletions and eight approved P1-002 empty scaffold deletions; remote counts remain the source basis until integration.

3. Responsibility map

Path/surface	Current responsibility	Definitive consumer/boundary	Current classification
router.php, .htaccess	HTTP routing, sensitive-path protection and real-file bypass	/api to api/index.php; explicit legal/QuickBooks/admin routes; one-segment page routing	CURRENT RUNTIME ENTRY; deployed document root remains unknown
index.php, login.php, admin-console.php	authenticated app shell, login and super-admin entry	session, role/module guard, global partials and dynamic page include	CURRENT RUNTIME ENTRY
config/page_routes.php	page slug-to-file registry	93 slugs, 90 unique targets at observation	CURRENT DYNAMIC LOADER INPUT
config/modules.php	module/page access map	88 keys at observation	CURRENT ACCESS/MODULE INPUT
api/index.php	API v2 discovery and dispatch	fixed platform manifest plus sorted app/shared/*, app/addons/*, app/systems/*/* route globs; 34 manifests	CURRENT RUNTIME ENTRY; folder depth is a compatibility boundary
cron.php	scheduled CLI dispatch	DB/provider/logging effects vary by named job	CURRENT JOB ENTRY; active scheduler/host identity unknown
config/	session/bootstrap, paths, page/module maps and env loading	page/API/job flows; document-root and .env assumptions	CURRENT RUNTIME CONFIGURATION
app/platform/	auth, tenant, menu, module, audit, process and platform concerns	page/API/config callers	FIRST-PARTY PLATFORM SOURCE
app/shared/	shared API, file, endpoint, sync, table, UI and controller mechanisms	API glob and direct includes	SHARED TECHNICAL SOURCE; placement does not grant business authority
app/systems/{YMS,TMS,WMS,OMS,BMS}/	business-module handlers, helpers and routes	API/page/job and cross-module callers	BUSINESS SOURCE; physical folder is not sufficient proof of process authority
app/addons/	optional Gmail/report/AI/QuickBooks/Telegram behavior	API glob, jobs and direct includes	ADD-ON SOURCE; effects remain add-on-specific
app/controllers/	specialized or compatibility direct endpoints	legacy/direct callers	COMPATIBILITY SOURCE; caller-zero not established
app/utils/	mixed DB/provider/application utilities and vendored trees	broad direct includes	MIXED; 31,686 tracked paths require package/license/owner classification
frontend/pages/	server-rendered page source	page registry and index.php include path	FIRST-PARTY PRESENTATION SOURCE
frontend/partials/	global shell, dependencies and inline behavior	global include, filemtime() and optional public assets	ACTIVE RUNTIME COMPOSITION, not passive templates
frontend/scss/, frontend/tailwind-runtime.css	authored style inputs	scoped Tailwind build	AUTHORED BUILD INPUT
public/	direct endpoints, authored assets, vendor/compatibility and generated output	router real-file bypass, global/page tags and build outputs	MIXED WEB ROOT; blanket move/classification is unsafe
public/gmail/, public/integrations/, public/quickbooks-time/, public/legal/, public/telegram/	OAuth, webhook, callback, legal and machine endpoints	direct HTTP or explicit rewrite	PUBLIC RUNTIME ENTRY; auth/retry/deployed reachability is endpoint-specific
integrations/gmail-addon/	Google Apps Script client source	deployed add-on calls public/gmail/addon.php	EXTERNAL CLIENT SOURCE; deployed revision unknown
scripts/frontend-build/, scripts/tailwind-runtime/, scripts/kj-table-bundle/	build registry and two declared build units	exact inputs, outputs and verifiers	SCOPED BUILD; manifest verification passed
voice-gateway/	standalone TypeScript Twilio/WebSocket Runtime	its own build/start/test and service examples	SEPARATE PACKAGE RUNTIME; active service/deployed parity unknown
tests/	PHP unit/integration/integration-DB and Node contract checks	PHP runner discovers top-level *_test.php in three suite folders	MIXED TEST SOURCE; root Node tests have no one canonical runner
non-build scripts/	import, migration, DB, seed, mapping, operation, repair and validation	explicit operator/manual invocation	MIXED TOOLING; per-script effect/rollback owner incomplete
database/	support SQL, migrations, seeds and reference	explicit operator use	SUPPORT SOURCE; DB truth remains verified schema/current DB evidence
docs/	Product, plan, process, manual, research and evidence	humans, agents and the in-app manual PHP adapter	DOCUMENTATION; selected paths are Runtime inputs
.agents/	rules, skills and historical reference	agent routing	ENGINEERING CONTROL SOURCE; not business Runtime
reference/	historical YP/MK source copies	explicit migration research	HISTORY/REFERENCE; active Runtime use unproven
.codex/, .github/	Codex project configuration and collaboration metadata	local tooling/collaboration	TOOLING; no tracked GitHub Actions workflow
storage/, media/	intended Runtime file state and protected media	logs/cache/temp/export/media consumers	MIXED STATE; tracked warehouse-map evidence under storage/ is a conflict
Git metadata	release identity fallback	config reads env, then .git/HEAD, refs and packed refs	RUNTIME OBSERVABILITY INPUT; not guaranteed in every deployment

4. Build and test findings

node scripts/frontend-build/verify-manifest.mjs exited 0 with status ISOLATED_COMPAT:

• build members: tailwind-runtime, kj-table-bundle;
• excluded Runtime unit: voice-gateway;
• unresolved root-workspace/host/artifact-parity gaps.

Declared generated outputs are limited to the Tailwind Runtime CSS and KJ table bundle/JSON paths. Other public/ files are not inferred generated.

The PHP runner currently discovers 86 unit, one integration and zero integration-DB top-level test files. HEAD has 27 root Node .test.mjs files. The root checks do not aggregate every Node test. This observation does not prove test coverage or a passing suite.

5. Local private/generated state

Existence-only inspection found ignored/private .env, several node_modules trees, ignored voice-gateway/dist, output/ and an untracked empty tmp/. No secret/private content was read.

An already-running Mac performance-harness Apache/PHP-FPM sidecar was also inspected read-only. It listens on 127.0.0.1:18081; its external config names the current checkout as DocumentRoot, uses AllowOverride None, and applies its own router rewrite. It serves the worktree directly, so no separate copy/exclusion step exists for that sidecar. This is not evidence for Hub or Production Apache, .htaccess, deployed SHA, service or mount behavior.

Current conflicts/unknowns:

• root package.json/lock are absent; no root Node workspace is current;
• ignored scripts/kj-ui-standard/node_modules exists while its manifest/lock is absent;
• Config::$TEMP_PATH points to /temp, which is absent locally; unrelated /tmp exists;
• .agents/rules/ARCHITECTURE.md mentions resources/views, which is absent from current Git and the checkout;
• caller-zero app/bootstrap/, app/routes/ and app/portals/{client,driver,scale}/ speculative scaffolding was removed after RP6 approval;
• scripts/migrations/ has 237 tracked files and current path consumers, while database/migrations/ has one SQL file with unknown applied state; no current migration runner/ledger/operator lineage proves one canonical physical owner;
• storage/media/temp/output mount, owner, backup and deploy semantics are unverified.

6. Move gates and unknowns

The responsibility target is approved, but no source move is approved. Downstream owning Tasks must resolve before moving the affected owner:

1. Hub/Production Apache/PHP document root, deploy copy/exclusion and direct-file reachability; the Mac harness sidecar is recorded separately;
2. active cron/service descriptors and SHA parity, including voice gateway;
3. per-script effect/dry-run/rollback classification;
4. app/utils and public package/version/license/maintenance ownership;
5. storage/media/temp/output mounts, permissions, backup and external operator consumers;
6. complete page/API/PHP/JS/CSS/build/test/document caller maps for any proposed move.

Until then, current Runtime entries, glob depths, public paths, build outputs, consumer-bound docs and external paths remain fixed.

7. Verification

Check	Result	Meaning
Runtime/tree observation through origin/qa@cd26f23f4	PASS	6614c9fd9..cd26f23f4 added 13 root Node tests and changed bounded Runtime/UI/test files with no repository-owner drift; audited source identity only, not deployed Runtime proof
decision basis	PASS / LOCAL	remote Reset Revision 10 plus uncommitted Revision 27
tracked path counts and no symlink/submodule	PASS	current Git shape only
page/module/API manifest counts	PASS	current declared loaders only
node scripts/frontend-build/verify-manifest.mjs	exit 0 / ISOLATED_COMPAT	two isolated build units; three blocking host/root-parity gaps remain
source build/rebuild	NOT_RUN	no generated output changed
tests/browser/DB/provider/service/Production	NOT_RUN	outside this read-only map
Mac Local harness document root/copy inspection	PASS / PARTIAL	worktree is the observed sidecar docroot with no copy step; not deployment proof
Hub/Production document root/deploy/service/mount proof	BLOCKED	cannot be established from the Mac Local RO environment

---

Source: docs/research/platform-foundation/2026-07-30/current-repository-responsibility-map.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.