docs(adr): unify A2A/MCP/webhook/API under one domain, path-routed

[stephane-segning]

1. Summary

This PR changes:

• Adds ADR-0109 (unify A2A/MCP/webhook/API under code-intelligence-api.ai.camer.digital,
  path-routed: /a2a, /mcp, /api/v2 including multi-forge webhook paths).
• Updates ROADMAP.md: adds Epic [Epic]: Unify service domain under code-intelligence-api.ai.camer.digital #492, fixes the dangling "ADR-0098" reference to point directly
  at PR feat(a2a): stream review findings per-finding at finalize (ADR-0098, #457) #458 instead of a nonexistent ADR file, and adds a new "Retired" section documenting the
  closure of Epic [Epic]: Durable task orchestration on Restate (RFC-0005) #294 (Restate, dead since ADR-0093) and Epic [Epic]: A2A-compliant agent surface (RFC-0006) #295 (A2A's own-Ingress topology,
  superseded by this ADR).

It solves:

• Routes are flat/unversioned, a legacy /github/webhook alias is still live, no GitLab/Bitbucket
  webhook path exists, A2A planned its own Deployment/Ingress (the opposite topology from
  RFC-0007's stated direction), and nothing MCP-shaped is externally reachable. Tracked by 6 new
  stories under Epic [Epic]: Unify service domain under code-intelligence-api.ai.camer.digital #492 ([Story]: Migrate every route to /api/v2 #506–[Story]: Fix the dangling ADR-0098 roadmap reference #511).

---

2. Intent

The intent of this PR is:

Give RFC-0007's already-accepted "one binary hosts serve/a2a/mcp" direction a concrete domain and
path scheme, and formally retire the two now-superseded epics (#294, #295) in the roadmap.
Docs-only.

---

3. Scope

In Scope

• ADR-0109 (new file).
• ROADMAP.md's Epic [Epic]: Unify service domain under code-intelligence-api.ai.camer.digital #492 entry, the ADR-0098 reference fix, and the new Retired section.

Out of Scope

• Any implementation (tracked in stories [Story]: Migrate every route to /api/v2 #506–[Story]: Fix the dangling ADR-0098 roadmap reference #511).
• The actual k8s Ingress/DNS/TLS work — lives in ai-helm/ai-helm-values, tracked as a
  cross-repo companion ([Story]: ai-helm/ai-helm-values companion — Ingress/DNS/TLS for code-intelligence-api.ai.camer.digital #510).

---

4. Verification

I verified this change by:

• Checking logs — n/a (docs-only change)
• Running automated tests
• Running manual tests
• Checking metrics
• Testing error cases
• Testing permissions/security behavior
• Testing rollback or failure behavior, if relevant

Commands run:

grep -n "ADR-0098" ROADMAP.md
gh issue view 294 --json state -q .state
gh issue view 295 --json state -q .state

Results:

(no remaining false "ADR-0098" label — the line now links PR #458 directly)
CLOSED
CLOSED

---

5. Screenshots / Evidence

Not applicable — markdown-only change.

---

6. Risk Assessment

Risk level:

• Low
• Medium
• High

Potential risks:

• Externally exposing /mcp (story [Story]: Expose review-mcp externally over HTTP/SSE at /mcp #508) is new attack surface — flagged in Epic [Epic]: Unify service domain under code-intelligence-api.ai.camer.digital #492's own risk
  register, not something this docs PR itself introduces.

Mitigation:

• The security review for /mcp exposure is called out explicitly as a story-level gate, not
  assumed to happen implicitly.

---

7. AI Usage Declaration

AI was used for:

• Understanding existing code
• Drafting documentation
• Generating code
• Refactoring
• Generating tests
• Reviewing the diff
• Not used

Human verification:

• I understand every meaningful change in this PR
• I checked generated code manually
• I checked generated tests manually
• I removed unsupported AI assumptions
• I accept responsibility for this PR

AI-drafted (Claude); human-verification boxes intentionally left unticked for
@stephane-segning's review.

---

8. Reviewer Focus

Please focus your review on:

• Correctness
• Architecture
• Security
• Performance
• Tests
• Maintainability
• Product intent
• Edge cases

Source of truth: Epic #492 and its new child stories (#506–#511). Stacked on
#adr/353-state-machine-backbone — merge the prior two PRs first.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8240f59

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

✅ AI Governance check passed

This PR declares AI usage, references a source of truth, and provides verification evidence. Thank you.