The two service deployments

A production install runs one Rust application in two operational roles:

• navigator-web — the public portal, Navigator MCP/API routes, webhooks, health probes, embedded Rego authorization, and client-facing Documents/Engagements/Invoices views.
• workflows-service — the durable Restate worker that renders documents, advances workflows, sends emails, and runs the background side effects the portal schedules.

The split keeps the portal stateless: every side effect that needs durable retries belongs to the worker rather than to a request handler. Lawyer and admin users with Project access work the matter through the firm workbench, over the participation-scoped list that surface resolves for them. Clients use the portal file surface: they see only Projects where they have a person_project_roles row, and the portal renders reviewed documents, Engagements, and invoices without exposing storage vocabulary or GCS credentials.