refactor(backend): move project collaboration domain to a dedicated stack

Relocates the project, conversation, document, assessment, and design-progress resolver Lambdas — 14 functions, 10 data sources, 23 resolver attachments, 4 event rules, 2 alarms — from the backend stack into a new projects stack that attaches to the same GraphQL API, following the established satellite pattern. The backend stack drops from 500 resources (the CloudFormation ceiling) to 375. Relocated functions carry no pinned names, eliminating recreation collisions; every stateful resource keeps its logical id and policies in place.

All seven restructuring gates pass over the populated move manifest: removals-only template diff, 39 stateful logical-id pins, cross-stack resolver parity, IAM privilege equivalence for relocated roles, and byte-level behavioral equivalence of resolver mapping templates. Deploy order is backend first then projects; rollback is the reverse — the choreography is documented in the operator plan.

Author: Oliver Gibbs

README.md

@@ -96,7 +96,7 @@ Service (AgentCore Runtime · Gateway · Knowledge Base)
 Gateway (per-app API Gateway · authorizer · metrics)
 ```
 
-Deployed as focused CDK stacks: `backend`, `services`, `governance`, `arbiter`, `frontend`, `gateway`, and `telemetry`.
+Deployed as focused CDK stacks: `backend`, `projects`, `services`, `governance`, `arbiter`, `frontend`, `gateway`, and `telemetry`.
 
 ## Getting started
 

backend/bin/app.ts

@@ -10,6 +10,7 @@ import { FrontendStack } from "../lib/frontend-stack";
 import { GatewayStack } from "../lib/gateway-stack";
 import { GovernanceStack } from "../lib/governance-stack";
 import { TelemetryStack } from "../lib/telemetry-stack";
+import { ProjectsStack } from "../lib/projects-stack";
 
 const app = new cdk.App();
 
@@ -36,6 +37,33 @@ const backendStack = new BackendStack(app, `citadel-backend-${environment}`, {
   description: `Backend infrastructure for Citadel - ${environment}`,
 });
 
+// Projects satellite stack — backend-stack-split phase 1 (decision 30e6d067).
+// Owns the projects/conversations/documents/assessment/design-progress/
+// planning/chatter domain, moved out of BackendStack. Depends on backend
+// only, for the shared API/bus/tables/bucket/pool passed in as props;
+// resolvers attach to BackendStack's AppSync API via the L1 cross-stack
+// pattern (see projects-stack.ts).
+const projectsStack = new ProjectsStack(
+  app,
+  `citadel-projects-${environment}`,
+  {
+    ...stackProps,
+    description: `Projects domain satellite for Citadel - ${environment}`,
+    appSyncApi: backendStack.appSyncApi,
+    agentEventBus: backendStack.agentEventBus,
+    projectsTable: backendStack.projectsTable,
+    conversationsTable: backendStack.conversationsTable,
+    agentStatusTable: backendStack.agentStatusTable,
+    documentBucket: backendStack.documentBucket,
+    idempotencyTable: backendStack.idempotencyTable,
+    adrsTable: backendStack.adrsTable,
+    executionSpecificationsTable: backendStack.executionSpecificationsTable,
+    agentDesignAssessmentsTable: backendStack.agentDesignAssessmentsTable,
+    userPool: backendStack.userPool,
+  },
+);
+projectsStack.addDependency(backendStack);
+
 // Services stack (depends on backend)
 const servicesStack = new ServicesStack(
   app,
@@ -332,6 +360,7 @@ if (app.node.tryGetContext("nag") !== "false") {
   ];
   for (const stack of [
     backendStack,
+    projectsStack,
     servicesStack,
     arbiterStack,
     frontendStack,
@@ -439,7 +468,7 @@ if (app.node.tryGetContext("nag") !== "false") {
   ];
   const resourceStarPaths: Array<[cdk.Stack, string]> = [
     [
-      backendStack,
+      projectsStack,
       "DocumentUploadResolverFunction/ServiceRole/DefaultPolicy/Resource",
     ],
     [