# Realtime contracts

`Publication` is the common typed browser-message envelope. It carries one
`DeliveryTarget`: canonical Project ID, canonical Party ID or principal subject.
The publisher selects the audience and payload; the restricted gateway validates
the publisher's owner and permitted target kinds before deriving the Centrifugo
channel. Channels are absent from publisher APIs.

The `projection` field retains its wire number and contains a registered
context-specific Protobuf message. `operation_rejected` carries command and
correlation identity plus the recorded rejection and requires a principal target.
Add fields compatibly, regenerate with `pnpm generate:contracts` and verify stored
bytes separately from generated-file drift.

Execution Core's `RunProjection` is delivered to its canonical Project audience.
The Run ID, Project ID and revision remain in the typed message so clients can
apply only newer state.
Its additive `member_sign_in_required` field marks a terminal consent refusal.
Clients display one sign-in-again notice per Run to the matching `member_id`;
duplicate delivery or another Run's progress does not add a second notice.
Older stored projections omit the field and decode to `false`. The existing
Project audience and wire identities remain unchanged.

Support's `SupportTicketProjection` and `SupportMessageProjection`
(`support.proto`) are delivered to the owning user's principal target; its
customer and ticket-sync aggregates are private and never published.

Party Governance's `PartyProfileProjection` (`party_governance.proto`) carries
the saved profile and social links to the owning principal. Its aggregate kind
is `party_profile`, its aggregate ID is the canonical Party ID and the envelope
revision orders updates. Private profiles use the same owner-only delivery.
Public readers use the visibility-filtered HTTP query. The Party readiness
channel never carries profile data.

The API's technical authentication authority publishes `SessionReadinessChanged`
(`authentication.proto`, envelope owner `authentication`, kind `session_readiness`)
to the canonical Party target. Its revision increases per Party. This is an
invalidation notification: each browser reads its own current session snapshot.
It carries no session reference, provider identifier, credentials or permission.
An additive payload leaves the existing envelope and projection wire numbers
unchanged. Old clients reject this unrecognised message; deploy the new browser
and API/gateway together for automatic readiness progression.