ADR-015: Fix wrong repo URL and fabricated infra module names

[nicholas-ruest]

Implements the analytics-hub portion of agentics-enforcement/plans/adr/ADR-015 (steps 6 and 12).

What was wrong

Rust. Cargo.toml:56-62 declared seven llm-infra-* crates from https://github.com/LLM-Dev-Ops/llm-infra. That repo does not exist, and the crate names were fabricated on top of the wrong URL. Both verified before changing anything:

$ git ls-remote https://github.com/LLM-Dev-Ops/llm-infra
remote: Repository not found.
fatal: repository 'https://github.com/LLM-Dev-Ops/llm-infra/' not found

$ git ls-remote https://github.com/LLM-Dev-Ops/infra
a8bc89c190f63b139812f30a54e21a25b8f70e81	HEAD

This was build-blocking, not dormant. On main before this change:

$ cargo build --workspace
    Updating git repository `https://github.com/LLM-Dev-Ops/llm-infra`
warning: spurious network error (3 tries remaining): unexpected http status code: 404
error: failed to get `llm-infra-cache` as a dependency of package `llm-analytics-hub v0.1.0`
Caused by: unable to update https://github.com/LLM-Dev-Ops/llm-infra?branch=main
Caused by: unexpected http status code: 404; class=Http (34)

npm. frontend/package.json:54-56 declared @llm-dev-ops/llm-infra-{core,config,logging}. The real package is a single @llm-dev-ops/infra with subpath exports (infra/sdk/ts/package.json).

What changed

infra publishes 19 flat, separately-named crates and has no aggregator, so core/logging/tracing are not misspellings — they are an invented facade. Mapping used:

Declared	Real	Note
llm-infra-config	infra-config
llm-infra-logging	infra-otel	logging and tracing are one crate
llm-infra-tracing	infra-otel
llm-infra-cache	infra-cache
llm-infra-retry	infra-retry
llm-infra-ratelimit	infra-rate-limit
llm-infra-core	infra-errors	the error-utilities half; the aggregator half maps to nothing and is dropped

The source is pinned to rev = "a8bc89c..." rather than branch = "main", per ADR-015 §4. infra has zero tags, so a rev is the only pinnable ref.

The six per-crate feature aliases collapse into the implicit features of the optional dependencies, leaving the infra umbrella feature. infra-logging/infra-tracing/infra-ratelimit disappear as feature names because they no longer correspond to distinct crates. This is safe: no source file in the repo references llm_infra_*, and no #[cfg(feature = "infra...")] exists, so there are zero call sites to update. These features also never built, so nothing working is being removed.

npm collapses the three entries into "@llm-dev-ops/infra": "^0.1.0" — the exact form already used by the correct consumers (governance-dashboard/frontend:44, observatory/sdk/nodejs:52, shield/package.json:7). No import rewrites were needed: grep -rn "@llm-dev-ops" frontend/src/ returns nothing, so there are zero import sites.

Verification — real output

The six crates resolve and compile from the real repo at the pinned rev. Built in an isolated scratch crate declaring exactly the six new dependencies:

   Compiling infra-otel v0.1.0 (https://github.com/LLM-Dev-Ops/infra?rev=a8bc89c1...#a8bc89c1)
   Compiling infra-rate-limit v0.1.0 (https://github.com/LLM-Dev-Ops/infra?rev=a8bc89c1...#a8bc89c1)
   Compiling infra-config v0.1.0 (https://github.com/LLM-Dev-Ops/infra?rev=a8bc89c1...#a8bc89c1)
   Compiling infra-cache v0.1.0 (https://github.com/LLM-Dev-Ops/infra?rev=a8bc89c1...#a8bc89c1)
   Compiling infra-retry v0.1.0 (https://github.com/LLM-Dev-Ops/infra?rev=a8bc89c1...#a8bc89c1)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 08s
exit=0

Manifest and feature table validate: cargo metadata --no-deps exits 0. To confirm that check is not vacuous, temporarily replacing infra-config with a bogus name in the infra feature list makes it exit 101; restoring returns it to 0.

cargo build --workspace still fails — on a different, pre-existing bug that is out of scope for this PR:

    Updating git repository `https://github.com/LLM-Dev-Ops/infra`
error: no matching package named `cost-ops` found
location searched: Git repository https://github.com/LLM-Dev-Ops/cost-ops?branch=main
required by package `llm-analytics-hub v0.1.0`

Note the resolver now fetches LLM-Dev-Ops/infra successfully and gets past the infra stage — that progression is the evidence this fix works. The new blocker is Cargo.toml:44, untouched by this PR (git diff main -- Cargo.toml shows no cost-ops line). See "Left undone" below.

npm install still fails, and this fix cannot make it pass:

npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/@llm-dev-ops%2finfra - Not found

@llm-dev-ops/infra is not published to the public npm registry. Checked each scoped dependency directly:

Package	Public npm
@llm-dev-ops/infra	404 not published
@llm-dev-ops/observatory-sdk	0.1.1
@llm-dev-ops/llm-registry-sdk	0.1.0
@llm-dev-ops/llm-infra-core (old)	404 not published

So npm install failed before this change and fails after it — the difference is that it now fails on a name the fleet actually owns rather than one nobody publishes. This is expected: ADR-015's own check spec resolves @llm-dev-ops/* ranges "against the fleet package index", not public npm. By that rule the declaration is correct — infra/sdk/ts/package.json is @llm-dev-ops/infra at 0.1.0, and ^0.1.0 is satisfied. Every correct consumer named in the ADR is in the same position; publishing the package is fleet-level work, not an analytics-hub change.

No tests were run: the crate cannot link until the cost-ops blocker is resolved, and the frontend cannot install its dependencies.

Left undone

1. Cargo.toml:44 — cost-ops is the same bug class and now the next blocker. It declares cost-ops = { git = ".../cost-ops", branch = "main" }, but cost-ops is only a [[bin]] name inside crates/llm-cost-ops-cli/Cargo.toml; the real library package is llm-cost-ops. This is not listed in ADR-015's mismatch table, so it has no vetted mapping, and choosing between llm-cost-ops and llm-cost-ops-sdk is a judgment call. Left for a decision rather than guessed at.
2. integration-manifest.json:156-261 still lists the fabricated @llm-dev-ops/llm-infra-* names and the old infra-logging/infra-tracing/infra-ratelimit feature flags. It is a planning document, not a build input, but leaving it will hand the same fabricated names to the next reader. Out of scope here; worth a follow-up.
3. frontend/package-lock.json is already out of sync with package.json on main — it contains zero @llm-dev-ops/* entries. It could not be regenerated because @llm-dev-ops/infra is unpublished. Pre-existing, unchanged by this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.