# Research company catalog client

This slice synchronizes the full Research provider specification from
`vernonkeenan/research` draft PR #32 at provider commit
`ca6a2911ce79d053f9aa338e6d9bcfe3357b0c77`. The pinned internal spec SHA-256
is `c213fe19077453fcdc8f8ce3f6d1671cbbb5074f348c9e4ee0739f64ab0ebba3`;
the external copy differs only by Lib's conventional scheme, host, and base
path rewrite.

The generated CompanyProduct surface contains:

- shared list/detail through `GET /companyproducts`;
- safe tenant-attributed create through `POST /companyproducts`; and
- no direct update or delete.

The generated CompanyService surface contains:

- shared list/detail through `GET /companyservices`;
- safe tenant-owned create through `POST /companyservices`;
- optimistic-concurrency update through `PUT /companyservices`; and
- no delete.

Every operation retains one compound security alternative containing both
`ApiKeyAuth` and `kvSessionCookie`. Callers supply one
`runtime.ClientAuthInfoWriter` that writes the native service credential and
forwards only the `kvSession` cookie. Credential values do not enter the
generated models, source, tests, or logs.

Product update remains intentionally proposal-only. The separate generated
proposal client records, submits, and independently reviews Product changes;
review does not itself apply or publish the authoritative Product. This Lib
slice does not invent application, publication, bulk, media-ownership, or
delete operations.

## Dependency and release gate

This Lib PR may be reviewed while Research PR #32 is open, but it must not be
released until:

1. Research PR #32 is merged, released, and deployed;
2. the KV Studio native service principal has the exact governed scopes
   `research:company-product:read`, `research:company-product:create`,
   `research:company-service:read`, `research:company-service:create`, and
   `research:company-service:update`;
3. Research production smoke tests prove the native catalog paths and zero
   Salesforce reads or writes; and
4. KV Studio is ready to pin the new Lib tag, preserve the Product proposal
   workflow, and run its Playwright list/detail/create/Service-edit coverage.

There is no database migration in this client slice. Research remains
responsible for proving ownership through the existing
`research.companyproduct`, `research.companyservice`, and
`crm.account.tenantid` contracts. Any future schema change must use the
governed database runner and its own recovery plan.

This slice grants no scope, changes no credential, creates no Lib release, and
performs no deployment.