AppServices

Purpose and authority boundary

NexusScholar.AppServices coordinates already-verified domain objects for application consumers. It creates deterministic projections, replays proposed journal changes before persistence, and validates that commit ports return the exact previewed head. It contains no Avalonia, database, HTTP, provider, or model-client code.

AppServices is not ResearchWorkspace. AppServices works over supplied verified objects and abstract commit ports. ResearchWorkspace owns the local-folder implementation, atomic generations, path safety, and durable reconstruction.

Service families

• SearchDedupWorkspacePlanComposer maps Search import and Deduplication evidence into deterministic, renderer-neutral WorkspacePlan blocks. Every block is AppProjection, not Core authority.
• DecisionSnapshotAuthorityProjectionService exposes authority-generation health, policy identity, snapshot identity, unresolved count, and policy-binding consistency.
• DeduplicationReviewApplicationService.Preview derives membership effects, representative selection, invalidations, and unresolved status from a verified FE-02 command.
• WorkflowExecutionJournalApplicationService rehydrates current and proposed event chains, then requires the commit port to return the previewed execution id, head digest, and event count.
• ScreeningConductApplicationService previews title/abstract outcomes, conflicts, and handoff readiness.
• FullTextScreeningConductApplicationService applies the same replay/commit contract to Full Text conduct.
• ReviewExportOrchestrator verifies exact report, workspace cut, Bundle v2 manifest, and observed inventory before allowing a human-recorded export request.

Preview and commit pattern

verified current authority + proposed entries
                    |
                    v
          replay current journal
          replay combined journal
                    |
                    v
      immutable preview: prior/result head,
      counts, projections, conflicts, readiness
                    |
        caller supplies an implementation port
                    |
                    v
      commit result must exactly match preview
      or AppServices rejects the integration

The pattern prevents a persistence adapter from claiming success for different bytes or a different chain head. It does not itself provide transaction isolation; the port implementation must enforce stale-write and atomicity rules appropriate to its storage boundary.

Determinism and failures

Workspace-plan composition uses canonical JSON payloads, stable block ordering, stable evidence refs, and no current timestamps or machine-local paths. Journal services rely on domain rehydration, so invalid transitions, bad actors, unresolved prerequisites, chain breaks, and stale record refs fail before a commit port is invoked.

Export preparation is stricter: only an identified human may record an export; report and Bundle workspace identities must match; source generations must reproduce the workspace cut; the exact canonical report bytes must exist in the observed inventory; and the request receives its own canonical digest.

Dependencies and extension points

AppServices depends on the domain packages it projects and on UiContracts for app-facing plans. Core domain projects never depend back on AppServices. To add durable storage, implement the narrow commit port in an outward adapter and return the exact verified result; do not add EF Core or filesystem behavior to this project.

To add a new application workflow, prefer a change record, deterministic preview, narrow commit port, and exact result-match check. Any new service that creates scientific authority directly would violate this package’s role.

Tests and evidence

AppServices tests cover deterministic composition and serialization, generated local bundles, authority health projection, and application-service behavior. Domain and conformance tests cover journal refusal logic.

The initial projection boundary is accepted in ADR 0015; FE-02 through FE-06 ADRs authorize the later preview/commit surfaces.

Explicit nonclaims

No storage, transaction, UI, authentication, API, provider, network, plugin, model runtime, or independent scientific authority is implemented here. A WorkspacePlan is a projection. A validated preview is not a committed record.