Audit the public facade boundary

docs/roadmap/implementation.md

@@ -1,8 +1,8 @@
 # Public facade: implementation plan
 
-Status: not started. Baseline: `28e7fc5f690b36c60e4d03586afcff00fb1dee90`.
-The [feature roadmap](public.md) owns the target architecture and user intent.
-This plan owns implementation decisions, ordered work, validation, and handoffs.
+Status: complete (2026-09-12). Baseline: `28e7fc5f690b36c60e4d03586afcff00fb1dee90`.
+The [feature roadmap](public.md) owns the implemented architecture and user intent.
+This completed plan records implementation decisions, ordered work, validation, and handoffs.
 Each numbered stage is sized for one gpt-5.6-terra coding-agent assignment;
 no stage requires subagents or changes to downstream repositories.
 
@@ -508,7 +508,7 @@ boundary and brings documentation in line with the completed architecture.
 
 ## Stage 9 — Audit the public boundary and finalize documentation
 
-Status: not started.
+Status: complete (2026-09-12).
 
 1. Compare the final complete exported API against the baseline. Audit public
    signatures, fields, aliases, embedded types, method sets, and error returns
@@ -538,6 +538,29 @@ supported baseline and newer Go toolchains recorded in the release procedure.
 Record actual versions/platforms; do not treat Linux tests or cross-builds as
 native macOS release evidence. Do not publish or select a version in this stage.
 
+### Completion
+
+Audited the final root facade against the established public surface and added a
+root AST boundary check for exported aliases, fields, and signatures involving
+internal types. The dependency boundary check now also rejects root production
+imports that bypass the engine and internal production imports of the root.
+The completed root retains only facade wrappers, records, conversions, and
+entry-point delegation; engine mechanism tests own lifecycle behavior.
+
+Updated the architecture policy, ADR status, component overview, development
+test/fuzz navigation, and public-facade roadmap to describe the implemented
+layout. The roadmap is now a completed implementation record rather than a
+future plan. Root facade integration and engine tests cover source ownership,
+exact-type secret binding, callback activity/audit, structured errors, detached
+configuration versus frozen inspection, and resolution entry snapshots.
+
+Linux validation passed with Go 1.25.5 and Go 1.26.7 through
+`CONFIGKIT_BASELINE_TOOLCHAIN=go1.25.5 CONFIGKIT_NEWER_TOOLCHAIN=go1.26.7 ./scripts/release-check.sh`.
+It also passed the everyday check, full race suite, consumer examples, and local
+documentation/import/public-boundary tests. This is not native macOS evidence
+and no release version, tag, or publication was selected. There were no
+deviations or remaining risks.
+
 ## Open Questions
 
 None requiring a user decision were identified. Wrappers, public type ownership,

docs/roadmap/public.md

@@ -1,8 +1,8 @@
 # Public facade and internal implementation
 
-Status: agreed direction; not implemented. This roadmap defines the desired end
-state and user intent. The [implementation plan](implementation.md) owns the
-ordered work, concrete adapter design, validation commands, and handoffs.
+Status: implemented on 2026-09-12. This roadmap records the intended architecture
+and user intent; the completed [implementation plan](implementation.md) records
+the ordered work, validation, and handoffs.
 
 ## Intent
 
@@ -31,13 +31,13 @@ design. Existing [configuration contracts](../config.md) and exported Go
 declaration comments remain authoritative. The user-approved wrapper boundary is
 a contributor design choice, not a strengthening of consumer behavior contracts.
 
-## Current architecture
+## Implemented architecture
 
-The root currently owns both public declarations and most private implementation:
-source acquisition, imports, composition and overlays, reflection descriptors,
-decoding, resolution and validation coordination, provenance, history, secret
-handling, and rendering. The [component overview](../internal/overview.md) owns
-the detailed inventory.
+The root owns public declarations, records, wrappers, and deliberate forwarding.
+`internal/engine` owns source acquisition, imports, composition and overlays,
+reflection descriptors, decoding, resolution and validation coordination,
+provenance, history, secret handling, and rendering. The
+[component overview](../internal/overview.md) owns the detailed inventory.
 
 Two established internal boundaries already exist: `internal/document` owns the
 parser-independent tree, and `internal/yaml` owns upstream YAML integration.
@@ -49,7 +49,7 @@ callback state; `Path` holds semantic segments; and `Secret` holds private
 reference and resolved-value state. Moving implementation requires deliberate
 type ownership, not just file relocation.
 
-## Target architecture
+## Architecture
 
 ### Public root package
 
@@ -140,7 +140,7 @@ need to change an established contract requires a separate explicit decision.
 Version selection and publication remain governed by the
 [release policy](../policy/release.md), not by this roadmap.
 
-## Completion criteria
+## Completion evidence
 
 Completion means the root is a legible public surface, substantive plumbing is
 internally owned, consumers require no migration, and representative