---
id: w2/m11/t002
title: "Implement: public creates write store rows instead of the CR directly"
worker: worker2
status: todo
estimate: 1h
depends_on: [w2/m11/t001]
---

## Objective

Implement t001's design: `POST /v1/services`, GraphQL `createService`, and MCP `create_web_service`/`deploy` write to the internal store instead of writing the `App` CR directly.

## Context

- `lego/backend/internal/apps/rest.go`, `graphql.go`, `mcp.go` — the three public create entry points.
- `lego/backend/internal/store/` — internal store API this needs to call into.

## Steps

1. Change each public create handler to call the internal store's create path instead of directly constructing/applying the `App` CR.
2. Ensure the store app-id label and tenant label (from t001's design) are attached so the projector picks these rows up correctly.
3. Preserve existing response shapes on all three surfaces — this is an internal plumbing change, not a contract change.

## Files

- `lego/backend/internal/apps/{rest,graphql,mcp}.go`
- `lego/backend/internal/store/`

## Acceptance criteria

- [ ] Creating a service via REST/GraphQL/MCP results in a store row + projected CR, not a directly-applied CR.
- [ ] Response shapes on all three surfaces are unchanged from before this task.

## Out of scope

- Clone-secret minting in the projector — that's t003.
