Summary

Extract the authoritative deterministic router into a portable shared core for the native iPhone/iPad runtime while keeping the current Rust gateway on the same implementation.

Scope

• rename wayfinder-core to wayfinder-routing-core and update every Rust consumer;
• add wayfinder-runtime-contracts for secret-free requests, destination snapshots, exclusions, route plans, explanations, and receipts;
• add deterministic pre-score readiness, privacy, context, modality, tool, streaming, and Automatic-eligibility filters;
• add stable same-tier selection and pre-output fallback order;
• add an explicit gateway-versus-embedded parity test;
• enforce the pure-core production dependency boundary from a manifest test;
• record the partial Phase 1 implementation status in WF-ADR-0048 and WF-ROADMAP-0016.

Out of scope: Swift bindings, XCFramework assembly, provider execution placement, iOS UI, credentials/authentication, Apple Foundation Models execution, and Mac pairing.

Product / Architecture Decisions

• Rust remains the only routing authority; no Swift routing implementation is introduced.
• Host runtimes provide secret-free destination snapshots. Credentials, network execution, storage, UI, and Apple frameworks stay outside the routing core.
• Hard compatibility and privacy exclusions run before complexity scoring.
• Automatic never crosses to a different tier implicitly; candidates within the recommended tier retain caller-supplied order.
• A pinned-destination runtime and cross-route execution policy remain outside this bounded extraction.

User-Facing Contract

No current macOS or gateway behavior changes. This creates the embedded planning seam required for standalone native iPhone and iPad routing.

Verification

• cargo fmt --manifest-path rust/Cargo.toml --all -- --check
• cargo test --manifest-path rust/Cargo.toml --workspace --all-features --locked
  • complete workspace green, including 151 gateway tests and the new gateway/embedded parity test;
  • two loopback server tests were run outside the filesystem sandbox so they could bind temporary local sockets.
• cargo clippy --manifest-path rust/Cargo.toml --workspace --all-targets --all-features --locked -- -D warnings
• cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1
• no remaining wayfinder-core / wayfinder_core references under rust/.

Review Path

1. Review wayfinder-runtime-contracts for secret-free platform-neutral types.
2. Review the new eligibility and planning functions in wayfinder-routing-core.
3. Review dependency_boundary.rs and embedded_gateway_parity.rs.
4. Confirm the remaining crate changes are mechanical package/import renames.
5. Confirm ADR/roadmap status does not claim the Swift bridge or physical-device gate is complete.

Notes For Reviewer

This PR is intentionally stacked on #114 (codex/rust-only-cutover) because #114 contains the merged Rust-only and native-mobile source-of-truth work but is not yet on main. Merge #114 first, then rebase/retarget this PR to main.