Domain Ownership

Status

Active

Date

2026-04-28

Owners

• Platform Backend

Last Verified Commit

Use git log -- <this file> for current last-touch history; this field is intentionally not pinned to a static hash so it does not become stale after unrelated commits.

Ownership Rules

This repo currently uses a shared database, but service ownership is logical and must still be respected.

Core rules:

• each domain has one primary runtime owner
• wallet_service is the only writer for player-wallet topology buckets and the legacy player-balance compatibility boundary
• edge services do not become hidden domain owners
• orchestration is allowed, but direct cross-domain mutation is not

Current exception: agent-domain money is still being migrated. Direct agent.balance / agent.coupon mutations remain in legacy-compatible admin and agent flows and must keep emitting audit/outbox/legacy-write metrics until their replacement owner command path is live.

Domain Map

Domain	Primary Owner	Edge Surface	Notes
player auth/profile/common data	player_service	gateway	includes registration helpers, profile, messages, captcha/common data
player balances, deposits, withdrawals	wallet_service	gateway and admin_service	money writes stay here even when initiated elsewhere
rolling lifecycle	rolling_service	wallet_service, admin_service, gateway	consumes wallet events and emits rolling events
coupons, rebate, cashback, lossback	promotion_service	gateway and admin_service	settlement and coupon saga logic lives here
provider callbacks and game integration	Aggregator authenticates native providers and resolves provider identity; game_service owns RGB protocol, policy, wallet and ledger effects	signed Aggregator relay through gateway	no direct provider traffic or normalized wallet callback surface exists in RGB
agent portal flows	agent_service	direct agent frontend traffic	includes legacy agent compatibility aliases
back-office operational APIs	admin_service	direct bo/admin traffic	also owns top-info websocket aggregation
SMS automation and reconciliation	recon_service	admin_service compatibility adapters	extracted from middle_server; no direct money mutation
player HTTP routing and legacy response translation	gateway	player-facing external traffic	edge only; owns no business data

Non-Negotiable Ownership Constraints

• recon_service may persist review or match state, but final approval must still flow through wallet_service.
• admin_service may orchestrate approvals and queries, but it must not become a second money writer.
• gateway may normalize or proxy payloads, but it must not persist domain state.
• worker loops must run under the owner service or owner worker runtime.

Multi-Brand Ownership

Per ADR-009, two new domain ownerships are added and one existing aggregate becomes brand-global:

Domain	Primary Owner	Edge Surface	Notes
brand catalog and per-brand configuration	admin_service	direct bo/admin traffic	owns brand and brand_config; brand defaults override documented globals
agent-to-brand allow list	admin_service writes; agent_service reads	admin_service exposes agent_brand CRUD; agent_service enforces it on every agent-facing route	controls which brands an agent can serve
agent aggregate	agent_service	direct agent frontend traffic	stays brand-global; per-brand variation lives in agent_setting(agent_id, brand_id) and agent_domain(agent_id, brand_id)

Brand isolation rules:

• every other domain owner above scopes its writes by brand_id
• wallet_service rejects any player-wallet command whose target row brand differs from request brand; ADR-005 still binds wallet_service as the target owner for player-wallet money
• gateway resolves brand from the request domain and forwards X-Brand-Id
• game_service resolves and verifies brand from Aggregator's signed RGB external-player context on callback
• back-office staff ownership is removed by this change and is not replaced

Migration Gap

The unresolved ownership area is the residual middle_server back-office scope outside recon:

• /api/admin/role/*
• /api/admin/menu/*
• /api/admin/config/*
• /api/admin/i18n/*
• /api/admin/bi/*
• /coin/*
• legacy POST /{path:path} catch-all forwarding

Those capabilities need an explicit owner before full legacy retirement.