NianAIGC/.project-docs/40-domain/business-rules.md

Business Rules

Durable Rules

• Production data backend selection is explicit and fail-closed: a PostgreSQL configuration failure must never silently fall back to local JSON.
• Billing amounts use integer-fen arithmetic; wallet balance enforcement and ledger insertion happen inside the PostgreSQL billing_post_wallet_entry function.
• Job claiming uses the PostgreSQL claim_generation_jobs function (FOR UPDATE SKIP LOCKED, lease, stale recovery); Go process-local locks must never replace it.
• Ordinary members cannot submit generation when the organization balance is insufficient; submission is rejected before provider dispatch.
• Super administrators calculate and record generation cost without checking, freezing, or refunding organization quota.
• All new organization balance entries are organization-owned; generation charge/refund entries keep member attribution for consumption reporting.
• Logged-in users may change their own password; account management and organization member actions require admin roles.
• Public /api/v1 access authenticates with API keys and stays outside browser SSO middleware; API data is partitioned by the API account owner.
• Database schema changes stay versioned and checksummed in database/migrations/; the initial production schema is created by manually executing the SQL files plus application-role grants (no migration Job pod), and schema changes must never run inside long-lived pod startup.
• Generated and uploaded assets remain runtime/object-storage state; PostgreSQL does not make them shared for horizontal scaling.

Open Questions

• The exact public /api/v1 compatibility promise to preserve for external consumers.

Last Reviewed

2026-08-14