Ejan
Shrestha

public class PolicyService : IPolicyService
{
    private readonly IPolicyRepository _repo;
    private readonly IEmailService _email;

    public PolicyService(IPolicyRepository repo, IEmailService email)
        => (_repo, _email) = (repo, email);

    public async Task<int> CreateAsync(PolicyDto dto)
    {
        var id = await _repo.AddAsync(dto.ToEntity());
        if (dto.Premium > 100_000) await _email.NotifyUnderwriterAsync(id);
        return id;
    }
}

// Red: written before Policy.Issue exists
[Fact]
public void Issuing_above_the_limit_needs_underwriting()
{
    var policy = Policy.Quote(Premium.Of(250_000m, "NPR"));

    var result = policy.Issue(Limits.Default);

    result.Should().BeOfType<NeedsUnderwriting>();
    policy.Status.Should().Be(PolicyStatus.Referred);
}

// Green: the smallest Issue() that passes.
// Refactor: now the rest of the design can move safely.

public sealed class Policy : AggregateRoot
{
    public PolicyStatus Status { get; private set; } = PolicyStatus.Quoted;
    public Money Premium { get; private set; }

    public Result Issue(Limits limits)
    {
        if (Premium > limits.AutoIssue) return Refer("needs underwriting");

        Status = PolicyStatus.Issued;
        Raise(new PolicyIssued(Id, Premium));
        return Result.Ok();
    }
}

public sealed class PolicyIssuedConsumer(ITreaties treaties, IPublishEndpoint bus)
    : IConsumer<PolicyIssued>
{
    public async Task Consume(ConsumeContext<PolicyIssued> ctx)
    {
        var msg = ctx.Message;
        var cession = await treaties.Cede(msg.PolicyId, msg.Premium);

        // No distributed lock: each service commits locally, the saga reacts
        await (cession.IsRejected
            ? bus.Publish(new CessionRejected(msg.PolicyId))
            : bus.Publish(new PolicyCeded(msg.PolicyId, cession.Share)));
    }
}

# ADR 0007: Cross-service writes

Status: accepted

| Option               | Consistency | Ops cost | Team fit |
|----------------------|-------------|----------|----------|
| Distributed tx (2PC) | strong      | high     | poor     |
| Outbox + saga        | eventual    | medium   | good     |
| Shared database      | strong      | low      | coupling |

Decision: outbox + saga over RabbitMQ.
Consequence: every consumer is idempotent (Redis keys).