Define repository structure and development workflow

[jornedesmedt]

Question

How should the monorepo organize deployable applications, reusable packages, generated contracts, documentation, tests, fixtures, build orchestration, CI, dependency pinning and updates, component ownership, reproducible builds where practical, release/container SBOM generation, and known-vulnerability scanning so human-supervised coding agents can work concurrently and verify changes independently?

Use selected secure-engineering practices because they are valuable; do not pursue or claim formal CRA compliance, automatic updates, or commercial support obligations.

[jornedesmedt]

Constraint settled in Choose the foundational technology stack:

The Ktor backend is a JVM deployable. jOOQ/jOOQ Kotlin, HikariCP, Flyway, Koin integrations, and any other JVM-only dependencies must remain in backend JVM modules/source sets. They must not leak into Kotlin Multiplatform commonMain, generated cross-language contracts, or client-shared domain models. If backend code is ever organized with KMP source sets, JVM-only infrastructure belongs under jvmMain; common code remains platform-neutral.