docs(refactor): complete final verification and handoff

AGENTS.md

@@ -48,7 +48,7 @@ Single binary hosts multiple sub-services via Cobra subcommands: `wallet`, `mark
 ### Config
 
 - **Go services** use `knadh/koanf` (not `fig` as older docs may suggest) to parse TOML config files
-- **Global singleton**: `config.Cfg` — a `sync.Once` ensures it's initialized exactly once
+- **Explicit ownership**: commands load configuration once and inject it through composition; legacy `config.Cfg` globals were removed
 - **Defaults baked into code**: `config.go` in `api/` sets default `ipg_callback_url` and `ui_server_error_status_url` before loading the TOML file (TOML overrides defaults)
 - **Struct tags**: use `koanf:"field-name"` (not env vars)
 
@@ -133,18 +133,19 @@ Proto definitions live in `proto/` with subdirectories: `base/`, `auth/`, `walle
 
 ## Go Service Layer Pattern
 
-Both `auth` and `wallet` follow a layered architecture:
+The active Go services follow inward-facing layers:
 
-- **`config/`** — TOML config via koanf. `config.Cfg` global singleton, `sync.Once` initialized.
+- **`domain/`** — entities, exact value objects, errors, and ports without transport/framework ownership.
+- **`application/`** — business policies and orchestration against domain ports.
+- **`infrastructure/`** — koanf configuration, PostgreSQL/Redis, external clients, queues, Stellar, and generated-client adapters.
+- **`interface/`** — gRPC/HTTP/process adapters and protocol mapping.
 - **`domain/stub/go/`** — Generated protobuf Go code. **Never edit manually.**
 - **`cmd/`** — Cobra CLI entry points. Subcommands map to serve modes.
-- **`repository/`** — Data access. Aggregates `IPostgres`, `IRedis`, `IService`, and `IQueue` (wallet only) interfaces.
-- **`core/`** (wallet) / **`usecase/`** (auth) — Business logic. Implements gRPC server interfaces from proto.
-- **`util/`** — Shared helpers; no business logic.
+- **`repository/` / `usecase/`** — remaining compatibility composition/interfaces; implementations live in infrastructure and new business logic belongs in application/domain.
 
 In `auth`, `usecase.UseCase` interface directly embeds the generated gRPC server interfaces (`authv1.AuthorizationServiceServer`, `authv1.InternalAuthorizationServiceServer`).
 
-In `wallet`, `core/` contains sub-packages: `walletImp/`, `marketImp/`, `alertImp/`, `cronJobs/`.
+In `wallet`, runtime adapters live under `interface/grpc` and `interface/process`; the superseded `core/*Imp` packages no longer exist.
 
 ## API Gateway Patterns
 
@@ -195,14 +196,14 @@ All Go services instrumented with Elastic APM and Prometheus metrics. Traefik ha
 7. **Proto stubs excluded from watchers**: `.air.toml` excludes `domain/stub/` from file watching. Air also excludes `swagger/` and `testdata/`.
 8. **API testing requests**: `api/req/` contains JS files for API request testing (axios-based) — not part of the app, useful for manual testing.
 9. **Django Admin**: Uses `unfold` theme (AdminPanel admin customizations in `sites.py` and `unfoldconf.py`).
-10. **Proto generation for AdminPanel**: Generates into root directories (`base/`, `wallet/`, etc.) then deletes them with `rm -rf`. The betterproto generator outputs Python classes directly.
+10. **Proto generation for AdminPanel**: `make proto` uses the adjacent local `proto/` checkout and generates only the active Base/Auth/Wallet BetterProto message subset into `src/stub/`.
 
 ## AdminPanel Deep Dive
 
 - **Architecture**: Django admin panel that reads `core_db` directly for fast projections. Unmanaged models are read-only by default; the Assets admin sends authenticated typed commands to Wallet instead of writing the database. Django DB routers route `coreLogic` reads to `core_db` and other apps to `default`.
 - **Models**: `src/coreLogic/models.py` contains `managed = False` Django models — manual replicas of Go GORM models generated via `inspectdb`. **Not auto-generated from protos.** `make proto` generates betterproto Python stubs separately but Django models are maintained by hand. **Never edit models.py manually** — it drifts from Go services.
-- **Admin classes**: `src/coreLogic/admin/` — 17 admin files (`asset.py`, `wallets.py`, `market.py`, etc.). All inherit from `MultiDBModelAdmin` in `src/utils/base_admin.py` which handles: multi-database writes (`using="core_db"`), soft deletes via `deleted_at`, asset-level permission filtering, and Jalali date widgets.
-- **Permission system**: `src/usermapper/user_perm.py` + `src/coreLogic/acl.py` — admin users get asset-level access control. `save_model` checks `user_perm.can_access_asset()` before allowing writes.
+- **Admin classes**: `src/coreLogic/admin/` — admin files inherit from `MultiDBModelAdmin` in `src/utils/base_admin.py`, which routes reads to `core_db`, applies asset-level filters/Jalali widgets, and makes unmanaged projections fail closed for add/change/delete. Assets opt into service-backed mutations only.
+- **Permission system**: `src/usermapper/user_perm.py` + `src/coreLogic/acl.py` — admin users get asset-level access control. Asset service commands enforce the same access decision before dispatch.
 - **Key gotchas**:
   - Asset policy and default metadata are owned by Wallet's `application/adminasset`; do not recreate them in Django.
   - The Wallet admin client requires matching AdminPanel `WALLET_ADMIN_GRPC_TOKEN` and internal-wallet `[admin-assets].token` configuration.