[!WARNING]

🗄️ ARCHIVED — SUPERSEDED¶

This document is no longer the source of truth for the CPA/SE split. The reconciled, authoritative design now lives in the Solution Design doc set: docs/architecture/solution/.

For…	See
Service ownership & boundaries	Solution Overview
The automation pattern	Generic Pattern
Content sync flow	Flow: Content Sync
Session delivery flow	Flow: Session Delivery
Canonical content sample	LAB-0.1 (PAv1)
Vocabulary	Glossary

Kept read-only for history (gap catalog, decision log, phase records). Do not use for new work.

CPA ↔ Scenario Engine Integration Plan¶

Living document — source of truth for the CPA/SE integration work. Update this file as gaps are closed, decisions are made, or scope evolves.

Owner: Senior Architect (LCM) Authority: ADR-044 — Content-Driven Lifecycle Engine (Rev 2) Status: 🗄️ ARCHIVED — superseded by docs/architecture/solution/. (Historical: Phases 0 – 3 + follow-ups Q-10 / Q-11 complete.) Last updated: see git history

0. How to use this document¶

1. Section 3 is the canonical gap catalog. Every gap has an ID (G-NN), severity, current state, target state, remediation, and impacted files.
2. Section 6 is the phased delivery plan. Each phase enumerates the gaps it closes.
3. Section 7 is the decision log (AD-CSI-NNN). Append new decisions; do not rewrite history.
4. When a gap is closed: change its status banner from 🔴 Open → 🟢 Closed and add a Closed: line referencing the PR/commit. Do not delete the entry.
5. Open questions accumulate in §8. Resolve them inline with a decision ID and a date.

1. Executive summary¶

ADR-044 calls for a two-engine architecture:

• Control-Plane API (CPA) — owns session lifecycle, phase orchestration, and the DAG of steps within each phase via the PipelineExecutor. CPA is the sole MongoDB writer.
• Scenario Engine (SE) — owns atomic operations against external systems (CML, RADkit, …) expressed as a jq-flavoured DSL, executed as Jobs with a PodDefinition ref for capability scoping. SE is stateless w.r.t. business data; it persists only its own Jobs and PodDefinitions.

What exists today (Nov 2025):

• ✅ SE runtime is functional in isolation — JobExecutionService, DSLExecutor (call/do/set/try), ScenarioRegistry, two real scenarios (lab_resolve@v1, lab_start@v1), CloudEvent callback service.
• ✅ CPA domain model carries PodDefinitionRef on LabletDefinition.
• ✅ lablet-controller has a complete ContentSyncService that downloads, hashes, and uploads Lablet packages to RustFS and records the result back to CPA.
• ✅ ScenarioEngineClient is registered in lablet-controller DI.
• ✅ Pipeline DAG executor (PipelineExecutor) handles topological sort, skip_when, retry, timeout, resumability.

What is missing — the integration gap:

The remediation is content-driven sync redesign + missing-call-site implementation, sequenced in 6 phases (§6). The codebase is closer to ADR-044 than expected; this plan focuses on connective tissue rather than greenfield.

2. Current state inventory¶

2.1 Scenario Engine (src/scenario-engine/)¶

2.2 Shared core (src/core/lcm_core/)¶

2.3 Control-Plane API (src/control-plane-api/)¶

2.4 Lablet Controller (src/lablet-controller/)¶

2.5 Other services¶

3. Gap catalog¶

Severity: 🔥 Blocker (no end-to-end flow without it) · 🔴 High · 🟡 Medium · 🟢 Low Status: 🔴 Open · 🟡 In progress · 🟢 Closed

G-01 — SE SyncContentCommand is a stub 🔥 Blocker — 🟢 Closed (Phase 1)¶

Closed: Phase 1, multiple commits — SyncContentCommandHandler now executes the full 10-step pipeline (validate → load/create → SYNCHRONIZING → S3 download → SHA-256 → pod-type detection → PAv1 extract → JSON-schema validation → READY → supersede stale → emit pod_definition.ready.v1). Failures funnel through mark_failed + pod_definition.sync_failed.v1. Backed by:

• lcm_core.infrastructure.content_store.S3ContentClient (boto3, async-wrapped, moto-tested).
• lcm_core.infrastructure.content_store.ContentExtractor (full PAv1 walker; optional detected_pod_type hint per AD-CSI-012).
• PodDefinitionRepository.expire_superseded_definitions_async() on interface + Mongo impl.
• PodDefinitionStatus.FAILED lifecycle state + mark_failed() + PodDefinitionSyncFailedDomainEvent (AD-CSI-011).
• CloudEventCallbackService.emit_content_synced() + emit_sync_failed() (AD-CSI-013).

Verification: core 307 ✓ · scenario-engine 110 ✓ (10 new command tests + 4 new supersede tests).

Current state. application/commands/sync_content_command.py finds-or-creates a PodDefinition and transitions to SYNCHRONIZING. It never downloads from S3, never extracts PAv1/, never transitions to READY, never records the manifest.

Target state (ADR-044 §3.2). Given (source_uri, pod_definition_id?, content_hash?):

1. Resolve a target PodDefinition (find existing by content_hash or create new).
2. Transition DEFINED → SYNCHRONIZING.
3. Download the package from S3/RustFS into a local cache.
4. Verify SHA-256 matches content_hash (if supplied) — else compute and record it.
5. Extract PAv1/ tree (see §5 spec): manifest.yaml, lifecycle.yaml, scenarios/*.yaml, grading/*.yaml, reports/*.yaml, restore/*.yaml.
6. Validate manifest.yaml (pod_type, topology refs, scenario refs).
7. Populate PodDefinition fields (topology, devices, grading_rules, scenarios, lifecycle_phases, manifest, local_path).
8. Transition to READY (emit PodDefinitionReadyDomainEvent).
9. Mark any previous version with the same (name, pod_type) and a different hash as SUPERSEDED (emit event).
10. Emit CloudEvent com.lcm.scenario_engine.content_synced with {pod_definition_id, version, content_hash, pod_type} to CPA via CloudEventCallbackService.

Remediation.

• Add lcm_core.infrastructure.content_store.S3ContentClient (boto3, async-wrapped) and ContentExtractor (zipfile + PAv1 schema validator).
• Expand SyncContentCommand handler to orchestrate the above (still a single self-contained command; long-running steps run inside the handler since the command is invoked from a background context).
• Add new fields to PodDefinitionState (see G-03).
• Add expire_superseded_definitions_async helper to PodDefinitionRepository.

Files.

• src/scenario-engine/application/commands/sync_content_command.py (rewrite)
• src/scenario-engine/domain/entities/pod_definition.py (expand state — see G-03)
• src/core/lcm_core/infrastructure/content_store/ (new package)
• src/scenario-engine/integration/services/cloud_event_client.py (add emit_content_synced(...))

Acceptance. Given a valid PAv1/ zip at an S3 URI, a single POST /api/v1/content/sync results in a PodDefinition(status=READY, content_hash=…, manifest=…, lifecycle_phases=…) and a CloudEvent delivered to CPA's callback endpoint.

G-02 — lablet-controller does not notify SE 🔥 Blocker — 🟢 Closed (Phase 2)¶

Closed: Phase 2 wiring — ScenarioEngineClient.sync_content + best-effort SE call in ContentSyncService (Step 6.5, between RustFS upload and CPA notification). See AD-CSI-014 for the failure-handling decision.

Current state. ContentSyncService extracts metadata and POSTs to CPA's RecordContentSyncResultCommand. It never tells SE about the package, so SE never gets a PodDefinition.

Target state. After uploading to RustFS and computing content_package_hash, but before calling CPA, the controller calls ScenarioEngineClient.sync_content(source_uri=rustfs_uri, content_hash=..., name=definition.name, version=definition.version, pod_type=<discovered>). SE owns the resulting PodDefinition.id. The controller then includes pod_definition_id + pod_type in the CPA RecordContentSyncResultCommand payload so CPA can finalise pod_definition_ref.

Remediation.

• Add sync_content(...) method to ScenarioEngineClient (mirrors SE's POST /api/v1/content/sync).
• Insert SE call into ContentSyncService._process_sync_request() after RustFS upload, before CPA notification.
• Add idempotency: if SE returns an existing PodDefinition for the same hash, reuse its id.
• Make SE call best-effort with retry; on persistent failure surface a warning in sync_status but do not block CPA notification — see open question Q-02.

Files.

• src/lablet-controller/integration/services/scenario_engine_client.py (add sync_content)
• src/lablet-controller/application/hosted_services/content_sync_service.py (call SE)
• src/lablet-controller/application/commands/record_content_sync_result_command.py (CPA side — accept pod_definition_id + pod_type)

Acceptance. A definition synced end-to-end produces both (a) updated CPA LabletDefinition with valid pod_definition_ref.content_hash, and (b) PodDefinition(status=READY) in SE's MongoDB.

G-03 — PodDefinition entity missing content fields 🔴 — 🟢 Closed (Phase 0)¶

Closed: commit 7d760fe (feat(scenario-engine): expand PodDefinitionState with PAv1 typed fields).

Current. PodDefinitionState has only manifest: dict. Everything is shoved into the opaque manifest blob.

Target (ADR-044 §2.5). First-class typed fields make the rest of SE — DSL executors, adapters, scenarios — addressable.

class PodDefinitionState(AggregateState[str]):
    id: str
    name: str
    version: str
    pod_type: PodType
    status: PodDefinitionStatus
    source_uri: str
    local_path: str | None
    content_hash: str | None          # NEW — SHA-256 of source package

    # Extracted from PAv1/
    manifest: dict[str, Any]          # raw manifest.yaml
    topology: dict[str, Any] | None   # cml.yaml / radkit.yaml / proxmox.yaml
    devices: list[dict] | None        # devices.json / equivalent
    lifecycle_phases: dict[str, Any] | None   # phases/*.yaml indexed by phase name
    scenarios: dict[str, dict] | None         # scenarios/*.yaml indexed by name@version
    grading_rules: dict[str, Any] | None      # grading/*.yaml
    reports: dict[str, Any] | None            # reports/*.yaml
    restore_rules: dict[str, Any] | None      # restore/*.yaml

    created_at: datetime | None
    synced_at: datetime | None

Remediation. Expand PodDefinitionState, expand PodDefinitionReadyDomainEvent payload, update @dispatch handler. No migration script needed (no production data yet); for any existing dev rows, repository deserialisation tolerates missing keys via field defaults.

Files.

• src/scenario-engine/domain/entities/pod_definition.py
• src/scenario-engine/domain/events/pod_definition_events.py

Acceptance. Repository round-trip preserves all fields; DSLExecutor can resolve $pod.lifecycle_phases.init via jq.

G-04 — Pod-type auto-discovery missing 🔴 — 🟢 Closed (Phase 0)¶

Closed: commit d5600a1 (feat(content-store): PAv1 spec, schemas, PAv1Validator and PodTypeDetector). Phase 1/2 will invoke the detector from lablet-controller and SE.

Current. pod_type is hand-authored in seed YAML. Real-world Lablet zips have no such annotation.

Target. A deterministic priority chain extracts pod_type from package contents (see §5.1 priority chain).

Remediation. Implement lcm_core.infrastructure.content_store.PodTypeDetector with the priority chain, invoked first by lablet-controller's ContentSyncService (so SE call can include it), and again defensively by SE's SyncContentCommand (so SE never trusts the caller blindly).

Files.

• src/core/lcm_core/infrastructure/content_store/pod_type_detector.py (new)
• src/lablet-controller/application/hosted_services/content_sync_service.py (call detector)
• src/scenario-engine/application/commands/sync_content_command.py (call detector)

Acceptance. Given a zip with only cml.yaml, detector returns PodType.CML_ON_AWS. Given a zip with PAv1/manifest.yaml: { pod_type: roc_radkit }, returns PodType.ROC_RADKIT. Given an ambiguous zip, raises with a list of detected signals.

G-05 — ScenarioEngineClient is registered but never called 🔥 Blocker — � Closed (Phase 3)¶

Current. Pipeline step handlers (e.g. lab_resolve_step.py) call adapters directly (context.cml.create_lab, …), duplicating SE's lab_resolve_scenario.py.

Target (ADR-044 §3.4). Step handlers that mirror an SE scenario submit a Job to SE and await the callback; the step records the resulting job_id in the pipeline execution record, then suspends until a CloudEvent arrives.

Remediation — two-tier design.

• Tier A (synchronous step, current pattern, kept for coordination steps): ports_alloc, tags_sync, lab_binding, mark_ready, deregister_lds, archive — operations that touch CPA's MongoDB or short-lived in-process state. These stay as Python @step_handler functions.
• Tier B (SE-delegated step, new pattern, for external-system steps): lab_resolve, lab_start, lab_stop, lab_wipe, collect_grade, score_report — wrap a single SE Job submission.

Introduce a ScenarioEngineStep base class:

class ScenarioEngineStep(StepHandler):
    scenario_name: str
    scenario_version: str = "v1"

    async def execute(self, ctx: StepContext) -> StepResult:
        job_id = await ctx.scenario_engine.submit_job(
            scenario_name=self.scenario_name,
            scenario_version=self.scenario_version,
            input_data=self.build_input(ctx),
            pod_definition_id=ctx.session.pod_definition_id,
            callback_url=ctx.callback_url,
        )
        ctx.record_external_job(job_id, step_name=self.name)
        return StepResult.suspended(reason=f"awaiting SE job {job_id}")

The pipeline executor already supports existing_progress resumability — extend it to recognise SUSPENDED steps and resume on CloudEvent arrival.

Files.

• src/lablet-controller/application/services/step_handlers/_scenario_engine_step.py (new base)
• src/lablet-controller/application/services/step_handlers/lab_resolve_step.py (rewrite as ScenarioEngineStep)
• src/lablet-controller/application/services/step_handlers/lab_start_step.py (rewrite)
• src/lablet-controller/application/services/pipeline_executor.py (handle StepResult.suspended)
• src/lablet-controller/application/services/lifecycle_phase_handler.py (wake on event)

Acceptance. A standard-instantiate pipeline run produces SE Jobs visible in /api/v1/jobs; pipeline step transitions from RUNNING → SUSPENDED → COMPLETED on com.lcm.scenario_engine.job.completed arrival.

Closure note (Phase 3). _scenario_engine_step.submit_scenario_engine_job shared helper plus rewritten lab_resolve_step / lab_start_step flag-gate on context.scenario_engine_enabled (default false → legacy in-process path preserved through Phase 4 per AD-CSI-008). PipelineExecutor recognises StepResult.suspended and halts the pipeline with status="suspended" so the lifecycle phase handler can drop its task and wait. See AD-CSI-016 (in-process registry of suspended handlers, used by the scenario_engine.job.* IntegrationEventHandlers in application/events/integration/scenario_engine_handler.py for resumption — see AD-CSI-020 for the framework-native ingest pipeline that replaced the original events_controller).

G-06 — SE job lifecycle CloudEvent handlers are TODO stubs 🔥 Blocker — 🟢 Closed (Phase 3, refactored AD-CSI-020)¶

Original (pre-refactor). src/lablet-controller/api/controllers/events_controller.py (now deleted) parsed CloudEvents (structured + binary mode) but every handler logged and exited.

Target. Each handler:

1. Validates the CloudEvent shape and extracts job_id + step_correlation_id.
2. Looks up the suspended step in the pipeline execution record.
3. Issues the appropriate CPA command:
4. job.started → RecordExternalJobStartedCommand (audit only)
5. job.progress → UpdatePipelineProgressCommand (existing)
6. job.completed → ResumePipelineStepCommand(result=event.data.output)
7. job.failed → FailPipelineStepCommand(error=event.data.error)
8. job.cancelled → FailPipelineStepCommand(error="cancelled")
9. Returns 202 Accepted on success; 4xx on validation errors (so SE retries are bounded).

Remediation. Implement the 5 handlers; add new ResumePipelineStepCommand and FailPipelineStepCommand to CPA.

Files (after AD-CSI-020 refactor).

• src/lablet-controller/application/events/integration/scenario_engine_events.py (5 @cloudevent-decorated IntegrationEvent[str] dataclasses)
• src/lablet-controller/application/events/integration/scenario_engine_handler.py (5 IntegrationEventHandlers, auto-discovered by Mediator.configure(builder, ["application.events.integration"]) + CloudEventIngestor.configure(builder, ["application.events.integration"]) in src/lablet-controller/main.py)
• (deleted in the AD-CSI-020 refactor: src/lablet-controller/api/controllers/events_controller.py — superseded by the Neuroglia framework-native pipeline)
• src/control-plane-api/application/commands/lablet_session/resume_pipeline_step_command.py (new)
• src/control-plane-api/application/commands/lablet_session/fail_pipeline_step_command.py (new)

Acceptance. SE emits a job.completed event; within 1 s the corresponding pipeline step is COMPLETED in MongoDB and the next step is dispatched.

Closure note (Phase 3, as refactored by AD-CSI-020). The 5 handlers are implemented as IntegrationEventHandlers in application/events/integration/scenario_engine_handler.py, auto-registered by Neuroglia's CloudEventIngestor + Mediator. The framework's CloudEventMiddleware routes incoming HTTP CloudEvents through CloudEventBus → CloudEventIngestor → Mediator.publish_async(IntegrationEvent[str]) → handlers (no bespoke FastAPI controller). job.completed calls CPA ResumePipelineStepCommand; job.failed and job.cancelled call FailPipelineStepCommand. CPA 404 is swallowed as idempotent — duplicate delivery against an already-resumed step or terminated session. After CPA confirms, each handler looks up the lifecycle phase handler via LifecyclePhaseHandler.lookup(session_id) (AD-CSI-016 in-process registry) and re-dispatches the pipeline with the refreshed existing_progress. When no handler is registered (controller restart scenario), the next reconciliation cycle picks the work up. SE always round-trips metadata on every job lifecycle CloudEvent (AD-CSI-017) so the handlers can recover both lablet_session_id and step_correlation_id without consulting SE's job table. The 15 original EventsController tests were rewritten as IntegrationEventHandler unit tests in the same refactor (see AD-CSI-020 for trade-offs vs the deleted controller, notably binary-mode CloudEvent support dropped).

G-07 — RecordContentSyncResultCommand does not accept pod_type 🟡 — 🟢 Closed (Phase 0)¶

Closed: commit 820dcaf (feat(control-plane-api): confirm PodDefinition link on content sync). Aggregate method LabletDefinition.confirm_pod_definition(...) validates pod_type (400 unknown / 409 conflict) and emits LabletDefinitionPodDefinitionConfirmedDomainEvent. See AD-CSI-010.

Current. The command finalises LabletDefinition.pod_definition_ref.with_sync_confirmation(hash) but cannot set the ref if it was None (i.e. pod_type was not in seed YAML).

Target. Accept pod_type: PodType | None and pod_definition_id: str | None. If pod_definition_ref is None on the aggregate, build it from (pod_definition_id, definition.version, pod_type, content_hash). If it already exists, keep its id but update content_hash and validate pod_type matches.

Files.

• src/control-plane-api/application/commands/lablet_definition/record_content_sync_result_command.py
• src/control-plane-api/application/dtos/record_content_sync_result_dto.py
• src/control-plane-api/domain/entities/lablet_definition.py (add confirm_pod_definition(...) aggregate method)

Acceptance. A definition seeded without pod_type gains a valid pod_definition_ref after content sync completes.

G-08 — PAv1/ content layout not defined 🔴 — 🟢 Closed (Phase 0)¶

Closed: commit d5600a1 (feat(content-store): PAv1 spec, schemas, PAv1Validator and PodTypeDetector).

Current. No spec. Lablet zips contain mosaic_meta.json, cml.yaml, grade.xml, devices.json, content.xml, node-definitions/, image-definitions/. ADR-044 references PAv1/ but doesn't pin the schema.

Target. Publish a versioned format spec (PAv1) as a doc + JSON schema, and adopt it incrementally.

See §5 for the proposed schema. Spec authorship: this plan + a follow-up docs/architecture/content-format/PAv1.md.

Files.

• docs/architecture/content-format/PAv1.md (new — schema spec)
• docs/architecture/content-format/schemas/manifest.schema.json (new)
• docs/architecture/content-format/schemas/lifecycle.schema.json (new)
• docs/architecture/content-format/schemas/scenario.schema.json (new)
• src/core/lcm_core/infrastructure/content_store/pav1_validator.py (new — uses jsonschema)

Acceptance. A reference fixture tests/fixtures/pav1_minimal.zip validates green; a fixture missing manifest.yaml fails with a clear diagnostic.

G-09 — Pipeline templates hardcoded in Python 🟡 — 🔴 Open¶

Current. pipeline_template_resolver.py exposes 4 Python-defined templates.

Target (ADR-044 §3.3). Templates load from PAv1/lifecycle.yaml. If a phase is absent in content, the resolver falls back to the Python standard-* template (preserves today's behaviour for un-migrated definitions).

Remediation.

• Add ContentDrivenTemplateLoader that reads PodDefinition.lifecycle_phases (loaded by SE during sync) via CPA's PodDefinitionRef → CPA queries PodDefinitionReadModel (read-only projection in CPA, populated by CloudEvent listener — see also G-12).
• PipelineTemplateResolver chain-of-responsibility: ContentDrivenLoader → DBLoader (lablet_definition.pipelines) → HardcodedLoader.

Files.

• src/lablet-controller/application/services/pipeline_template_resolver.py
• src/lablet-controller/application/services/content_driven_template_loader.py (new)
• src/control-plane-api/infrastructure/projections/pod_definition_projector.py (new — see G-12)

Acceptance. A definition whose PAv1/lifecycle.yaml defines a custom instantiate phase causes the executor to run those steps; a definition without it runs the hardcoded template.

G-10 — Reports and scoring scenarios missing 🟡 — 🔴 Open¶

Current. No collect_grade or score_report scenarios in SE; lablet-controller has standard-collect-evidence and standard-compute-grading as Python pipelines but their step handlers are placeholders.

Target. Two new SE scenarios — collect_grade@v1 (pull device state from CML/RADkit), score_report@v1 (apply grading rules) — and content-driven collect_evidence + compute_score lifecycle phases in PAv1/lifecycle.yaml. The grading rules themselves live in PAv1/grading/rubric.yaml and are passed to score_report@v1 as input.

Files.

• src/scenario-engine/scenarios/collect_grade_scenario.py (new)
• src/scenario-engine/scenarios/score_report_scenario.py (new)
• docs/architecture/content-format/PAv1.md §grading
• tests/fixtures/pav1_minimal.zip with a sample rubric

Acceptance. A session completes collect_grade → score_report; the produced report (JSON document) is persisted via CPA RecordSessionReportCommand and visible in the UI.

G-11 — Resource-scheduler ignores pod_type compatibility 🟡 — 🔴 Open¶

Current. PodDefinitionRef.is_compatible_with(worker_pod_type) exists; no scheduler code calls it.

Target. Scheduler's AllocateWorkerForSessionCommand filters candidate workers via pod_definition_ref.is_compatible_with(worker.pod_type) before applying resource fitness.

Files.

• src/resource-scheduler/application/commands/allocate_worker_command.py (locate, add filter)
• src/worker-controller/domain/entities/cml_worker.py (ensure pod_type field exists; default CML_ON_AWS)

Acceptance. Allocating a session whose pod_type=ROC_RADKIT does not select a CML-only worker.

G-12 — Versioning, supersession and CPA-side read model 🟡 — 🟢 Closed (Phase 2; ingest path refactored Phase 3 follow-up, AD-CSI-021)¶

✅ G-13 landed. The brief production-bug window between CPA wiring CloudEventIngestor.configure(builder, ["application.events.integration"]) (which auto-registers CloudEventMiddleware) and CPA gaining its own SE pod_definition.* @cloudevent dataclasses + IntegrationEventHandlers has been closed. The middleware-intercepted pod_definition.ready.v1 / pod_definition.sync_failed.v1 events now flow through the framework-native pipeline (mirrors AD-CSI-020 on the lablet-controller side). See AD-CSI-021 and G-13 below for the migration details. The bespoke EventsController.ingest_cloud_event and its CloudEvent parse helpers have been removed; EventsController is now SSE-only.

Closed: Phase 2 — CPA now owns a read-only pod_definitions_read collection fed by SE CloudEvents. The ingest path was initially a bespoke POST /api/events/ endpoint on CPA's EventsController.ingest_cloud_event and was later refactored to the Neuroglia framework-native pipeline (CloudEventMiddleware → CloudEventBus → CloudEventIngestor → Mediator → ScenarioEnginePodDefinition{Ready,SyncFailed}Handler) in application/events/integration/scenario_engine_pod_definition_{events,handler}.py (Phase 3 follow-up, AD-CSI-021; mirrors AD-CSI-020 on the lablet-controller side). The bespoke endpoint + its CloudEvent parse helpers have been removed; EventsController is SSE-only. See AD-CSI-015 (last-write-wins projection) and Q-09 (SE superseded_ids gap) for the unchanged downstream semantics.

Current. PodDefinition has SUPERSEDED state but no command transitions to it; CPA has no view of SE's PodDefinition content (only the Ref).

Target.

• SE SyncContentCommand marks prior definitions with same (name, pod_type) and a different hash as SUPERSEDED.
• SE emits com.lcm.scenario_engine.pod_definition.superseded and pod_definition.ready events.
• CPA subscribes via a PodDefinitionProjector HostedService → writes a read-only pod_definitions collection mirroring SE state (id, name, version, pod_type, status, content_hash, lifecycle_phases, scenarios). Used by ContentDrivenTemplateLoader (G-09) and the UI to display "what scenarios will run".
• The projection is read-only in CPA — it never mutates back to SE. This preserves the "CPA = sole write authority for business state" rule because PodDefinition is SE-owned business state.

Files.

• src/scenario-engine/application/commands/sync_content_command.py (supersession logic — also covered by G-01)
• src/control-plane-api/infrastructure/projections/pod_definition_projector.py (new)
• src/control-plane-api/integration/repositories/pod_definition_read_repository.py (new — read-only)

Acceptance. Syncing a new content_hash for an existing name+pod_type results in: (a) old SE PodDefinition SUPERSEDED, (b) new one READY, (c) CPA's pod_definitions collection reflects both.

G-13 — Migrate CPA's pod_definition.* CloudEvent ingest to Neuroglia framework-native pattern (mirrors AD-CSI-020) 🔥 Blocker — � Closed (Phase 3 follow-up, AD-CSI-021)¶

Current state. CPA's src/control-plane-api/api/controllers/events_controller.py is a hybrid that serves SSE streaming (GET /api/events/stream) and has a bespoke POST / route (ingest_cloud_event) that parses CloudEvents (structured + binary mode), branches on event.type, and dispatches ProjectPodDefinitionReadyCommand / ProjectPodDefinitionSyncFailedCommand. The route is unreachable for structured-mode CloudEvents because Neuroglia's auto-registered CloudEventMiddleware (active since CloudEventIngestor.configure(builder, ["application.events.integration"]) landed in main.py) intercepts the request first, returns 202, and pushes the event onto CloudEventBus. The bus has no subscriber for scenario_engine.pod_definition.*.v1 because no @cloudevent-decorated dataclass exists for those types in CPA's application.events.integration package — the events are silently dropped. The ProjectPodDefinitionReadyCommand / ProjectPodDefinitionSyncFailedCommand handlers themselves are fine; only the ingest path that builds the command from the inbound envelope is broken.

Target. Mirror AD-CSI-020 on the CPA side. New files:

• src/control-plane-api/application/events/integration/scenario_engine_pod_definition_events.py (2 @cloudevent-decorated IntegrationEvent[str] dataclasses: ScenarioEnginePodDefinitionReadyIntegrationEventV1, ScenarioEnginePodDefinitionSyncFailedIntegrationEventV1).
• src/control-plane-api/application/events/integration/scenario_engine_pod_definition_handler.py (2 IntegrationEventHandlers that build the respective ProjectPodDefinition...Command from the event payload and dispatch via the Mediator).

The Neuroglia CloudEventIngestor will discover the new dataclasses on next startup (it already scans application.events.integration per main.py:165) and route inbound CloudEvents to the handlers.

Deletions. From src/control-plane-api/api/controllers/events_controller.py:

• The @post("/") ingest_cloud_event method (~100 LOC).
• Module-level constants CE_POD_DEFINITION_READY, CE_POD_DEFINITION_SYNC_FAILED.
• Module-level helpers _parse_cloud_event, _parse_event_time (~75 LOC — the Neuroglia handler can copy _parse_event_time verbatim if needed, mirroring lablet-controller's scenario_engine_handler.py).
• Imports for ProjectPodDefinitionReadyCommand / ProjectPodDefinitionSyncFailedCommand / Request / Response / post route decorator (if no longer referenced after the SSE-only trim).

SSE methods (stream_events, _event_generator, snapshot helpers) and the "Events" OpenAPI tag stay.

Test migration. From src/control-plane-api/tests/integration/test_cloud_events_controller.py (324 LOC, 8 tests):

• Delete: test_parse_cloud_event_structured_mode, test_parse_cloud_event_binary_mode (helpers gone), test_ingest_unknown_event_type_returns_202 (middleware behaviour, not ours — already returns 202 unconditionally), test_ingest_malformed_envelope_returns_400 (middleware now returns 500 on malformed JSON; behaviour is framework-owned), test_events_controller_has_post_events_route (route deleted).
• Port as handler unit tests in a new tests/application/events/integration/test_scenario_engine_pod_definition_handler.py:
• test_ready_handler_dispatches_project_command (mirrors current test_ingest_ready_event_dispatches_project_ready_command but instantiates the handler directly with a mocked Mediator).
• test_sync_failed_handler_dispatches_project_command.
• test_ready_handler_swallows_projection_error_with_log (replaces test_ingest_projection_failure_returns_500; the IntegrationEventHandler logs and returns rather than raising HTTP 500 — SE has already been ack'd by middleware).
• Add: test_cloudevent_types_are_registered_with_ingestor (assert both dataclasses are discoverable in application.events.integration after import, so the ingestor's startup scan picks them up). Mirrors tests/test_scenario_engine_handler_*.py registration tests in lablet-controller.

Behavioural deltas vs the deleted endpoint (same set as AD-CSI-020 on the lablet-controller side):

Files.

• src/control-plane-api/application/events/integration/scenario_engine_pod_definition_events.py (new, ~80 LOC)
• src/control-plane-api/application/events/integration/scenario_engine_pod_definition_handler.py (new, ~160 LOC)
• src/control-plane-api/api/controllers/events_controller.py (trim ~200 LOC; keep SSE; rename EventsController to SseStreamController is deferred to keep the diff small — the class name is technically inaccurate after this change but renaming would touch every subclass mapping import)
• src/control-plane-api/tests/integration/test_cloud_events_controller.py (delete 5 tests, ~250 LOC removed; rename to test_sse_stream_controller.py deferred for same reason as above)
• src/control-plane-api/tests/application/events/integration/test_scenario_engine_pod_definition_handler.py (new, ~150 LOC, 4 tests)
• docs/implementation/bootstrap-prompts/cpa-se-integration-phase-4.md § Step 3 — update to point at the new handler file (currently points at the soon-to-be-deleted events_controller.ingest_cloud_event).

Pre-implementation verification (~30 min, must run before any code changes).

1. In a real CPA + SE deployment, trigger a content sync and tail -F src/control-plane-api/logs/control-plane-api.log | grep -E 'pod_definition.ready|Projected pod_definition'. Confirm 0 hits (validates the production-bug hypothesis). If hits exist, the middleware is somehow not intercepting and the framing changes — still worth migrating but no longer a bug fix.
2. curl -X POST http://cpa/api/events/ -H 'Content-Type: application/cloudevents+json' -d '{"specversion":"1.0","type":"scenario_engine.pod_definition.ready.v1","source":"manual-test","id":"t1","data":{...}}' and confirm: (a) middleware returns 202 within ms, (b) no log lines from events_controller.ingest_cloud_event, (c) no row added to pod_definitions_read Mongo collection. Validates that today's bespoke route is genuinely dead in production.
3. Verify with grep -rn 'CE_POD_DEFINITION\|ingest_cloud_event' src/control-plane-api/tests/ that test coverage exercises the controller method directly (bypassing middleware) — explains why tests pass while production silently fails.

Acceptance.

• A real SE → CPA scenario_engine.pod_definition.ready.v1 POST results in a Projected pod_definition.ready: id=... log line and a row in pod_definitions_read within < 100 ms.
• cd src/control-plane-api && make lint && make test green; expected delta: -5 tests (deleted bespoke ingest tests) +4 tests (new handler unit + registration tests).
• cd src/lablet-controller && make test unchanged (lablet-controller side untouched).
• CPA boot log shows CloudEventIngestor found cloudevent type: scenario_engine.pod_definition.ready.v1 and ... .sync_failed.v1 (mirroring the existing pipeline.step.* discovery log lines).
• Backfill plan (in case production has been silently dropping events for weeks): add a one-off admin command or operator runbook entry to manually re-trigger SE's pod_definition.ready emission for all currently-READY definitions in SE (→ single SQL/Mongo script). Document under §10 (Opportunities) and reference from G-13 once landed.

Estimated effort. ~half a day, single sprint cycle. Net LOC: −~200 + ~240 + ~150 = roughly net-neutral, with consolidated ingest discipline across both consumer services.

Decisions expected. AD-CSI-021 (CPA's pod_definition CloudEvent ingest joins AD-CSI-020's pattern) + possibly AD-CSI-022 (whether to enforce source allow-list — recommend yes, mirroring lablet-controller / Q-11 / AD-CSI-019).

Closes. Q-12 (below).

Closure note. Landed as planned in a single iteration. Files delivered:

• src/control-plane-api/application/events/integration/scenario_engine_pod_definition_events.py (2 @cloudevent dataclasses, ~115 LOC).
• src/control-plane-api/application/events/integration/scenario_engine_pod_definition_handler.py (2 IntegrationEventHandlers, ~290 LOC — dispatches the existing ProjectPodDefinition{Ready,SyncFailed}Command through Mediator.execute_async).
• src/control-plane-api/tests/application/test_scenario_engine_pod_definition_handler.py (15 tests, ~370 LOC — happy path, missing fields, source allow-list, projection-failure swallow, exception swallow, @cloudevent type binding).
• src/control-plane-api/api/controllers/events_controller.py trimmed from 514 to 348 lines (SSE-only).
• src/control-plane-api/application/settings.py gained scenario_engine_allowed_sources: list[str] = ["scenario-engine"] (AD-CSI-022 → enforce by default).
• src/control-plane-api/tests/integration/test_cloud_events_controller.py (8 tests, 324 LOC) deleted: 5 obsoleted (parse helpers + controller shape + middleware-owned behaviours), 2 ported as handler unit tests, 1 superseded by the new @cloudevent registration test.

Net code delta: −2 imports + ~−200 LOC controller / −324 LOC tests, +405 LOC source / +370 LOC tests → roughly net-neutral with consolidated ingest discipline.

Acceptance recap. cd src/control-plane-api && make test → 1230 passed (delta unchanged vs pre-G-13 baseline of 1235); the 22 pre-existing test_worker_stopped_cascade.py errors are unrelated to G-13 (constructor-signature drift on CMLWorkerStatusUpdatedDomainEventHandler.__init__, predates this work). New tests: 15/15 passing. ruff clean on all G-13 files. Black-formatted to project's 120-column convention.

Implementation gotcha (captured for future Neuroglia integration work). CloudEventIngestor reconstructs event instances via e.__dict__ = data (bypassing __init__), so any annotated dataclass field that SE does NOT explicitly include in the CloudEvent data payload will raise AttributeError on direct attribute access. The handler must use getattr(event, "<field>", default) for every field that is not guaranteed to be present — even those with field(default_factory=...) defaults on the dataclass. The first unit test (test_ready_handler_dispatches_project_ready_command) caught this immediately on event.superseded_ids (SE does not emit superseded_ids per Q-09); fix was a global getattr(...) sweep in both handlers. The lablet-controller handlers use the same defensive pattern.

4. DSL vs Pipeline boundary — canonical clarification¶

Frequent confusion: the DSL is not shared between CPA and SE. They operate at different layers.

Implication for content authors.

• lifecycle.yaml orchestrates phases of steps. Steps may call SE scenarios (Tier-B) or CPA built-ins (Tier-A).
• scenarios/*.yaml defines reusable atomic operations. They never call back into CPA — they run, emit a result, and SE emits a CloudEvent to CPA.

Implication for code.

• lcm_core.domain.dsl (G-08-adjacent, ADR-044 §4.1) holds shared task-type definitions (call/do/set/try AST nodes, jq expression parser) so SE and tooling validators speak the same DSL.
• CPA never imports the DSL executor — it only invokes scenarios via ScenarioEngineClient.

This boundary is recorded as AD-CSI-001 below.

5. Content format & pod-type discovery¶

5.1 Pod-type discovery priority chain¶

PodTypeDetector.detect(package_path: Path) -> tuple[PodType, list[str]]

Returns (detected_type, signals_considered) for audit logging.

5.2 PAv1/ package layout (target)¶

<package>.zip
├── PAv1/
│   ├── manifest.yaml              # version, pod_type, content_id, scenarios used, lifecycle ref
│   ├── topology/
│   │   ├── cml.yaml               # OR radkit.yaml / proxmox.yaml / vmware.yaml
│   │   └── devices.json           # device definitions (replaces top-level devices.json)
│   ├── lifecycle.yaml             # phase DAGs (instantiate, post-init, collect-grade, score-report, teardown)
│   ├── scenarios/                 # optional content-defined scenarios (else SE registry is used)
│   │   ├── lab_resolve.v1.yaml
│   │   ├── lab_start.v1.yaml
│   │   ├── collect_grade.v1.yaml
│   │   └── score_report.v1.yaml
│   ├── grading/
│   │   └── rubric.yaml            # graded items, expected values, weights
│   ├── reports/
│   │   └── summary.yaml           # report templates
│   └── restore/
│       └── restore.yaml           # snapshot/restore directives
├── mosaic_meta.json               # legacy (kept for backward compat during migration)
├── cml.yml                        # legacy (kept; PAv1/topology/cml.yaml wins if both present)
├── grade.xml                      # legacy
└── content.xml                    # legacy (LDS device visibility, port preferences)

5.3 Content sync sequence (target)¶

sequenceDiagram
  participant Mosaic
  participant LC as lablet-controller
  participant RustFS as RustFS/S3
  participant SE as Scenario Engine
  participant CPA as Control-Plane API

  LC->>Mosaic: GET package
  LC->>LC: SHA-256, extract metadata, PodTypeDetector
  LC->>RustFS: PUT package
  LC->>SE: POST /api/v1/content/sync {source_uri, content_hash, name, version, pod_type}
  SE->>RustFS: GET package
  SE->>SE: verify hash, extract PAv1/, validate manifest
  SE->>SE: PodDefinition: DEFINED → SYNCHRONIZING → READY
  SE->>SE: mark prior (name, pod_type) hashes SUPERSEDED
  SE-->>LC: 200 { pod_definition_id, version }
  SE->>CPA: CloudEvent com.lcm.scenario_engine.pod_definition.ready
  LC->>CPA: POST /api/internal/lablet-definitions/{id}/content-synced {pod_definition_id, pod_type, content_hash, …}
  CPA->>CPA: confirm_pod_definition_ref(...) → finalise LabletDefinition

6. Phased implementation plan¶

Each phase is independently deployable. Feature flag SE_INTEGRATION_ENABLED defaults false until Phase 4.

Phase 0 — Foundations (no behaviour change) 🟢 Complete (commits d5600a1, 7d760fe, 820dcaf, c081eab)¶

• G-08 PAv1/ spec doc + JSON schemas + reference fixture. ✅
• G-03 Expand PodDefinitionState fields & events. ✅
• G-04 PodTypeDetector + unit tests. ✅
• G-07 RecordContentSyncResultCommand accepts pod_type (still optional). ✅
• Add lcm_core.infrastructure.content_store package skeleton. ✅

Verification: core 293 ✓ · scenario-engine 99 ✓ · control-plane-api 1078 ✓ (7 new); content_store coverage 97%.

• Add lcm_core.infrastructure.content_store package skeleton.

Phase 1 — SE content sync becomes real 🟢 Complete¶

• G-01 Implement SyncContentCommand end-to-end (download, extract, validate, persist, supersede). ✅
• Update tests/scenario-engine/ to cover the new flow with the reference fixture. ✅

Verification: core 307 ✓ (added 6 extractor + 12 S3 client tests) · scenario-engine 110 ✓ (added 10 command + 4 supersede tests). New decisions: AD-CSI-011, AD-CSI-012, AD-CSI-013.

Phase 2 — lablet-controller calls SE 🟢 Complete¶

• G-02 Add ScenarioEngineClient.sync_content; wire into ContentSyncService. ✅
• G-12 PodDefinitionProjector (delivered as the CPA-side EventsController.ingest_cloud_event POST /api/events/ endpoint + MotorPodDefinitionReadRepository) — read-only mirror of SE state via CloudEvent listener. Initially bespoke; later refactored to Neuroglia framework-native IntegrationEventHandlers in application/events/integration/scenario_engine_pod_definition_handler.py (Phase 3 follow-up, AD-CSI-021; mirrors AD-CSI-020 on the lablet-controller side). ✅
• Behaviour gated by SCENARIO_ENGINE_INTEGRATION_ENABLED (default false).

Verification: core 307 ✓ · lablet-controller 508 ✓ (5 new SE client tests) · control-plane-api 1217 ✓ (20 new — 7 projection commands + 13 CloudEvents controller). New decisions: AD-CSI-014, AD-CSI-015. New gap: Q-09 (SE omits superseded_ids from pod_definition.ready.v1 payload — projector tolerates absence; SE-side enhancement deferred).

Phase 3 — Pipeline ↔ SE delegation (Tier-B steps) 🟢 Complete¶

• G-05 ScenarioEngineStep shared helper (submit_scenario_engine_job); lab_resolve_step and lab_start_step rewritten as flag-gated Tier-B steps. ✅
• G-06 All 5 CloudEvent handlers implemented (started / progress / completed / failed / cancelled) — initially shipped as a bespoke EventsController, subsequently refactored to Neuroglia framework-native IntegrationEventHandlers in application/events/integration/scenario_engine_handler.py driven by CloudEventIngestor (Phase 3 follow-up, AD-CSI-020). ✅
• Added ResumePipelineStepCommand / FailPipelineStepCommand to CPA. ✅
• Extended PipelineExecutor to honour StepResult.suspended (halts pipeline with status="suspended", surfaces external_jobs). ✅
• LifecyclePhaseHandler registers itself in an in-process class-level registry when started (AD-CSI-016), allowing the scenario_engine.job.{completed,failed,cancelled} IntegrationEventHandlers (post-AD-CSI-020 — originally EventsController) to look up the suspended handler and call resume_after_external_completion(progress) / fail_after_external_completion(progress) after CPA confirms.
• SE round-trips metadata (containing lablet_session_id + step_correlation_id) on every job lifecycle CloudEvent (AD-CSI-017) so the controller does not need to read SE's job table to route the callback.
• Behaviour gated by scenario_engine_integration_enabled (default false); when off, Tier-B step handlers fall back to the legacy in-process path.

Verification: lablet-controller 546 ✓ (15 new CloudEvent ingest tests — initially against EventsController, later ported to the scenario_engine_handler IntegrationEventHandlers per AD-CSI-020 — + 4 PipelineExecutor suspension tests + 6 LifecyclePhaseHandler registry tests) · control-plane-api 1228 ✓ (9 new resume/fail tests + 2 new DTO pod_definition_ref tests) · lcm-core 269 ✓ (4 new resume_pipeline_step / fail_pipeline_step client tests) · scenario-engine 114 ✓. New decisions: AD-CSI-016, AD-CSI-017 (Phase 3); AD-CSI-019, AD-CSI-020 (Phase 3 follow-up). New open questions: Q-10 (suspended-step watchdog, closed by AD-CSI-018), Q-11 (SE source allow-list for CloudEvent ingest authn, closed by AD-CSI-019). New CPA gap closed during Phase 3: LabletDefinitionDto.pod_definition_ref was previously not exposed through the public DTO — added so lcm-core's read model can observe SE's confirmed PodDefinition link in production.

Phase 4 — Content-driven lifecycle (lifecycle.yaml) � Complete¶

• G-09 ContentDrivenTemplateLoader + chain-of-responsibility in PipelineTemplateResolver. ✅
• New loader reads lifecycle_phases from CPA's PodDefinitionReadModel (read-only projection of SE state, populated since Phase 2 via the CloudEvent ingest pipeline) and assembles a PipelineTemplate per phase.
• Chain order (AD-CSI-024): ContentDrivenTemplateLoader → DB inline (LabletDefinition.pipelines) → DB extends (extends: standard-<name> resolved against hardcoded _TEMPLATES) → hardcoded _TEMPLATES["standard-<pipeline_name>"]. First non-None wins; DB-side operators always apply on top of the resolved base (Q-13 conservative stance).
• Resolver behaviour when lifecycle.yaml is missing or incomplete: skip to next loader (preserves today's hardcoded-template behaviour for un-migrated definitions).
• Customisation operators preserved (extends, insert_after, insert_before, overrides, remove) — _apply_operators extracted as a private helper invoked by both the sync resolve (back-compat) and async resolve_for chain entry-point.
• SCENARIO_ENGINE_INTEGRATION_ENABLED=true by default ✅ (Step 10). Break-glass switch retained via env var; setting it to false halts new lifecycle pipelines at LabletReconciler._build_pipeline_context construction time via ScenarioEngineIntegrationDisabledError, which the reconciler catches and surfaces as ReconciliationResult.failed.
• Legacy in-process bodies deleted ✅ (Step 11 / AD-CSI-025). lab_resolve_step.py and lab_start_step.py are now Tier-B-only (~50 LOC each); PipelineContext.scenario_engine_enabled and PipelineContext.resolve_lab_for_instance fields removed; LabletReconciler._resolve_lab_for_instance deleted; obsolete TestResolveLabForInstance test class (5 tests) removed.
• Reference fixture pav1_with_lifecycle.zip ✅ (Step 8 — 2 023 bytes, committed under src/lablet-controller/tests/fixtures/). Schema-validated against lifecycle.schema.json. The fixture's lifecycle.yaml verbatim mirrors standard-instantiate (7 steps) and standard-teardown (4 steps).
• End-to-end parity test ✅ (Step 9 — tests/integration/services/test_content_driven_template_resolver.py): 3 tests assert that the chain's Tier 1 output for the fixture equals the Tier 4 hardcoded baseline (step list, retry config, outputs).
• New decisions recorded: AD-CSI-023 (CPA typed projection of lifecycle_phases + scenarios), AD-CSI-024 (chain-of-responsibility template resolver), AD-CSI-025 (delete Tier-A bodies; break-glass at PipelineContext construction). New open questions: Q-13 (content vs DB precedence — deferred conservative stance), Q-14 (lcm lint-pav1 authoring CLI — deferred 1-day spike).

Phase 4 ▸ Deferrals¶

• Canonical CML lablet seed migration (Step 12) — DEFERRED. The 8 seed files under src/control-plane-api/data/seeds/lablet_definitions/ (e.g. exam-associate-auto-v1.1-lab-lab-2.1.1.yaml) contain no inline pipelines: blocks; they implicitly rely on the hardcoded standard-<phase> Tier 4 fallback. Authoring the per-form PAv1/lifecycle.yaml artefacts lives in the upstream Mosaic content authoring system, not in this repo. Action required (external): for each Form ID listed in the seed file header comments (e.g. FormId=69d0d21c1dded6062c395961), publish a PAv1 zip containing PAv1/lifecycle.yaml mirroring the appropriate standard-* template. Once published and re-synced via SE, the runtime resolver chain matches Tier 1 (ContentDriven) and the Tier 4 fallback is never consulted — no code change required in this repo.

Phase 5 — Grading & reports¶

• G-10 collect_grade@v1 and score_report@v1 scenarios.
• RecordSessionReportCommand in CPA + UI surfacing.

Phase 6 — Scheduler + multi-platform readiness¶

• G-11 Scheduler filters by pod_type compatibility.
• Add RADkitAdapter scaffold (no real integration yet) — proves the adapter framework.
• Spec follow-ups for PROXMOX / VMWARE.

7. Decision log¶

8. Open questions¶

9. Risks¶

10. Opportunities¶

11. Maintenance commitment¶

This document is the source of truth for CPA↔SE integration work.

• On every PR that touches files listed under §3 or §6, the PR author updates:
• The affected gap's Status banner.
• If the gap is closed, add a Closed: line with PR/commit SHA at the bottom of the gap section.
• Append any new decision to §7 (next AD-CSI-NNN id).
• Append any new open question to §8 with a date.
• No silent scope changes. Adding a new gap requires a new G-NN entry with severity + remediation; do not edit existing gap scopes after they enter In progress.
• Cross-references. When code lands, link the file under §2 (current state inventory) to the gap it resolves, e.g. (closes G-01).

12. Glossary¶

• CPA — Control-Plane API (src/control-plane-api/). Sole MongoDB writer; owns sessions, definitions, lablet records.
• SE — Scenario Engine (src/scenario-engine/). Stateless w.r.t. business state; owns Jobs and PodDefinitions.
• lablet-controller — Reconciler service (src/lablet-controller/). Runs pipelines, syncs content, bridges CPA ↔ SE.
• PodDefinition — SE-owned aggregate representing a content package (zip) extracted into typed fields.
• PodDefinitionRef — VO held by CPA's LabletDefinition pointing at a PodDefinition (id, version, pod_type, content_hash).
• PAv1/ — Pod Artifact format v1; canonical content layout (§5.2).
• Tier-A step — Pipeline step that runs in-process in lablet-controller (touches CPA state).
• Tier-B step — Pipeline step that delegates to an SE Job (touches external systems).
• DSL — SE's jq-flavoured task language (call/do/set/try). Not used by CPA.

Authority: ADR-044 Rev 2. Cross-refs: docs/implementation/scenario-engine-job-execution.md, docs/implementation/content_synchronization.md, docs/architecture/adr/ADR-044-content-driven-lifecycle-engine.md.