feat(pre-oss): ownership ratchets, SDK fixture, docs, evidence (7.x+8.x)

.github/dependabot.yml

@@ -9,6 +9,7 @@ updates:
       - /
       - /testdata/enterprise_module
       - /testdata/external_connector
+      - /testdata/external_feature_sdk
       - /connector-support/acp
       - /connector-support/openaicompat
       - /connectors/acp

.github/workflows/qa.yml

@@ -48,6 +48,7 @@ jobs:
             connector-support/**/go.sum
             testdata/enterprise_module/go.sum
             testdata/external_connector/go.sum
+            testdata/external_feature_sdk/go.sum
             tools/**/go.sum
 
       - name: Classify changed files
@@ -114,7 +115,7 @@ jobs:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: go-cache-qa-${{ runner.os }}-${{ hashFiles('go.sum', 'testdata/enterprise_module/go.sum', 'testdata/external_connector/go.sum') }}
+          key: go-cache-qa-${{ runner.os }}-${{ hashFiles('go.sum', 'testdata/enterprise_module/go.sum', 'testdata/external_connector/go.sum', 'testdata/external_feature_sdk/go.sum') }}
           restore-keys: |
             go-cache-qa-${{ runner.os }}-
             setup-go-
@@ -150,7 +151,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          for module in testdata/enterprise_module testdata/external_connector; do
+          for module in testdata/enterprise_module testdata/external_connector testdata/external_feature_sdk; do
             echo "== $module =="
             (cd "$module" && GOWORK=off go mod tidy -diff)
           done
@@ -184,7 +185,7 @@ jobs:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: go-cache-qa-${{ runner.os }}-${{ hashFiles('go.sum', 'testdata/enterprise_module/go.sum', 'testdata/external_connector/go.sum') }}
+          key: go-cache-qa-${{ runner.os }}-${{ hashFiles('go.sum', 'testdata/enterprise_module/go.sum', 'testdata/external_connector/go.sum', 'testdata/external_feature_sdk/go.sum') }}
 
       - name: Report unrelated PR bypass
         if: needs.changes.result == 'success' && needs.changes.outputs.test != 'true'

.kiro/specs/pre-oss-core-slimming/residual-ownership-inventory.md

@@ -0,0 +1,53 @@
+# Residual Ownership Inventory
+
+## Baseline & Implementation Metadata
+
+- **Specification**: `pre-oss-core-slimming`
+- **Inventory Date**: `2026-09-03`
+- **Implementation SHA**: `d2a5b53933d12dc66e03e51914166a5b5fe4520c`
+- **Merged-Main Baseline SHA**: `19cdabcb6f469df0783400c8d13f6670a7818e48`
+- **Target Full-Closure SDD**: `.kiro/specs/core-feature-ownership-full-closure/`
+
+## Classification Vocabulary
+
+Every residual responsibility, package boundary, and composition seam identified in this post-migration inventory is classified according to the following vocabulary:
+
+1. **`kernel invariant`**: Core proxy behaviors, routing, B2BUA state machine, wire protocols, security invariants, or execution primitives required even when all optional standard features are absent or disabled.
+2. **`generic extension mechanism`**: Provider-neutral extension substrate, hook pipelines, closed standard plane definitions, or execution facilities with multiple independent callers and zero feature-specific branching.
+3. **`concrete optional feature policy`**: Feature-specific domain logic, schemas, heuristics, actor override stores, prompt templates, or behavioral policies intended solely for a specific optional UX capability.
+4. **`feature-specific infrastructure/composition`**: Dedicated composition adapters wiring feature-specific lifecycle, prerequisites, engine configuration, or generation binding between infrastructure/runtime and concrete features.
+5. **`mixed/needs split`**: Subsystems currently combining kernel invariants or generic orchestration with concrete optional feature policies, requiring structural decomposition before relocation.
+
+## Residual Ownership Inventory Table
+
+| Responsibility | Current owner/package | Production consumers | Classification | Why retained/deferred | Full-closure action |
+| --- | --- | --- | --- | --- | --- |
+| Compaction-continuity coordination: process-owned branch coordinator (`BranchKey`/`BranchState` CAS authority, preview-intent, injection-watermarks, capsule commit coordination) | `internal/core/compactioncontinuity` | `internal/infra/compactioncompose`, `internal/infra/runtimebundle` | `mixed/needs split` | Pre-OSS scope was bounded strictly to three high-confidence moves (`toolcallrepair`, `secretguard`, `compactiondetect`). Relocating branch coordinator requires separating process-level CAS/branch identity from feature-specific compaction capsule schema/watermark semantics, which would expand scope beyond the pre-OSS release boundary. | Decompose in full-closure SDD: move feature-specific capsule/carrier/watermark domain types to `internal/plugins/features/compactioncontinuity/state`; retain only generic branch-state CAS coordination in core (or relocate entirely to feature state). Delete `internal/core/compactioncontinuity`. |
+| Conversation-view generic projection vs optional steering policy: replay-stable message identity and `never_backend` exclusion projection vs client-hidden model-visible persistent steering and local turn overlay policy | `internal/core/conversationview` | `internal/core/runtime`, `internal/core/b2bua`, `internal/core/continuity/bunstore`, `pkg/lipsdk/steering`, `pkg/lipsdk/nonforwardable`, `pkg/lipsdk/localturn` | `mixed/needs split` | B2BUA projection safety (never sending client-tagged content to backends) is a kernel proxy invariant tightly integrated into the execution pipeline, while persistent steering overlays and local turns are feature-specific UX capabilities. Splitting them cleanly requires creating a minimal `internal/core/conversationprojection` and moving steering/store/state to `internal/infra/conversationview` outside core. Deferred to maintain bounded pre-OSS scope. | Split in full-closure SDD: retain minimal kernel projection/identity in `internal/core/conversationprojection`; relocate steering CRUD/state, placement/missing-anchor policy, writer/registrar services, and store contracts/adapters to `internal/infra/conversationview` outside core. Delete `internal/core/conversationview`. |
+| Interleaved-thinking and interleaved-state: `[thinker]` routing grammar and cycle tracking vs optional thinker prompt, memo extraction, memo store/budget, and visible-stream sanitization policy | `internal/core/interleavedthinking`, `internal/core/interleavedstate` | `internal/core/routing`, `internal/core/runtime`, `internal/core/b2bua`, `internal/infra/runtimebundle` | `mixed/needs split` | `[thinker]` routing grammar, weighted thinker cycles, and continuation B-leg opening are routing/runtime authority and cannot be delegated to a normal feature hook. Memo extraction, memo content/bounds, large built-in thinker prompt, instruction-file loading, and visible-stream sanitization are optional UX policies. Splitting requires defining a narrow core consumer interface and separating cycle state from memo payload references. | Split in full-closure SDD: preserve `[thinker]` routing operator, cycle tracking, and output-commit orchestration in core; extract memo/shaping/sanitization policy to `internal/plugins/features/interleavedthinking` behind a narrow core consumer port (`internal/standardplugins/featurehost/interleaved.go`). Move memo payload/ref state to feature; delete `internal/core/interleavedthinking`. |
+| Terminal-decision policy store: process-owned bounded policy store for client/operator tri-state enablement overrides of terminal-decision feature across sessions | `internal/core/terminaldecisionpolicy` | `internal/core/terminal`, `internal/infra/runtimebundle` | `concrete optional feature policy` | Core request admission needs only an immutable snapshot of the effective enabled decision, but the mutable actor policy domain was retained in core in pre-OSS to bound the release scope. | Move mutable policy service outside core to `internal/standardplugins/featurehost/sessionpolicy` (or `internal/infra/sessionfeaturepolicy`). Standard-feature host owns it and supplies a narrow immutable reader/snapshot to core. Delete `internal/core/terminaldecisionpolicy`. |
+| Feature-specific public pkg/lipruntime host options/adapters: public host configuration options and typed adapters for reasoning semantic compression (`Options.ReasoningCompression`, `ReasoningCompressionOptions`, `EgressPolicy`, `EgressInput`, `EgressDecision`, `EgressAction`, and internal `adaptReasoningCompressionOptions`) | `pkg/lipruntime` | External embedding hosts via `pkg/lipruntime`, `internal/infra/runtimebundle` | `concrete optional feature policy` | Pre-OSS needed to preserve public source/binary compatibility for host composition of reasoning preservation semantic compression without redesigning the public host options API before the standard-distribution feature host is introduced in full closure. | In full-closure SDD, introduce a generic, startup-only typed feature host registration envelope (`FeatureHostRegistrations []featurehost.Registration` in `pkg/lipsdk/featurehost`). Move concrete reasoning egress policy types into a dedicated feature-specific SDK package, and remove `ReasoningCompression` field and adapters from `pkg/lipruntime`. |
+| Dedicated compaction-continuity compose adapter: dedicated composition adapter wiring compaction-continuity feature prerequisites, scheduler, resultmerge adapter, and candidate surface overlay into runtimebundle | `internal/infra/compactioncompose` | `internal/infra/runtimebundle` | `feature-specific infrastructure/composition` | Requirement 5 allowed `compactioncompose` to remain dedicated and forbade redesigning it solely for naming symmetry. Pre-OSS prioritized removing direct feature imports from `runtimebundle` over unifying compose adapters. | In full-closure SDD, evaluate measured duplication across all dedicated compose adapters; if justified, consolidate under the private standard-feature host (`internal/standardplugins/featurehost`) without exposing a dynamic DI container. |
+| Dedicated reasoning-preservation compose adapter: dedicated composition adapter wiring reasoning preservation config scan, prerequisite validation, trusted egress policy lookup, secret matcher/sanitizer requirement, service construction, and attempt/stream binders | `internal/infra/reasoningcompose` | `internal/infra/runtimebundle` | `feature-specific infrastructure/composition` | Created in Task 6.1 to isolate concrete reasoning feature assembly from generic `runtimebundle`, achieving zero concrete feature imports without premature generic DI abstractions. | In full-closure SDD, transfer ownership of reasoning composition from `internal/infra/reasoningcompose` to `internal/standardplugins/featurehost` as part of standard feature lifecycle consolidation. |
+| Dedicated secret-guard compose adapter: dedicated composition adapter wiring secret-guard engine construction, pattern matcher settings, audit chaining, and candidate overlay/reload into runtimebundle | `internal/infra/secretguardcompose` | `internal/infra/runtimebundle` | `feature-specific infrastructure/composition` | Converged in Task 6.2 to ensure `runtimebundle` has zero concrete secret-guard implementation imports while preserving candidate reload behavior. | In full-closure SDD, transfer ownership of secret-guard composition from `internal/infra/secretguardcompose` to `internal/standardplugins/featurehost`. |
+| Keep-warm policy and scheduling: configuration, policy, scheduling, manager registry, lifecycle, administration, and accounting adaptation for prompt-cache maintenance / keep-warm background pings | `internal/core/keepwarm` | `internal/core/runtime`, `internal/infra/runtimebundle`, `internal/core/config` | `concrete optional feature policy` | Discovered during architecture audit as optional UX / background cache optimization. Retained because pre-OSS scope was strictly bounded to the three high-confidence migrations. Relocation requires defining a narrow core consumer interface for foreground turn/session lifecycle facts. | Move keep-warm implementation to `internal/plugins/features/keepwarm`; define a narrow core consumer interface under `internal/core/runtime` for lifecycle facts (turn start, session end, committed turn). Standard-feature host constructs and owns the feature. Delete `internal/core/keepwarm`. |
+| Optional feature configuration in core config: optional feature YAML configuration parsing, default values, large built-in thinker prompts, and validators embedded directly in core configuration structures (`prompt_cache.go` keepwarm config, `interleaved.go` thinker prompt/config) | `internal/core/config` | `internal/core/keepwarm`, `internal/core/interleavedthinking`, `internal/infra/runtimebundle` | `mixed/needs split` | Core config mixes essential proxy operational settings with optional UX feature configurations and prompt templates. Splitting configuration schemas before standard feature registration/decoding was established would break YAML config parsing. | In full-closure SDD, migrate optional feature configuration blocks (keepwarm, interleaved thinker prompts/budgets) to feature-owned configuration schemas decoded via standard feature registrations. Retain only base proxy operational settings in `internal/core/config`. |
+
+## Summary Counts by Classification
+
+| Classification | Count |
+| --- | --- |
+| `kernel invariant` | 0 |
+| `generic extension mechanism` | 0 |
+| `concrete optional feature policy` | 3 |
+| `feature-specific infrastructure/composition` | 3 |
+| `mixed/needs split` | 4 |
+| **Total Findings** | **10** |
+
+## Durable Handoff & Governance Statement
+
+Every deferred ownership boundary, mixed-responsibility package, and feature composition adapter identified during the `pre-oss-core-slimming` implementation is recorded in this durable inventory artifact.
+
+**No deferred finding lives only in transient history, chat context, or PR discussion.**
+
+All 10 findings are directly consumed as the authoritative baseline and backlog for the follow-up full-closure specification (`.kiro/specs/core-feature-ownership-full-closure/`), ensuring that pre-OSS scope remains firmly bounded while guaranteeing that long-term architectural simplification is systematically tracked and delivered.