# Migration Step 4 Implementation Plan

## Status

Complete as of 2026-07-28. The public-facade adapter boundary and its
post-implementation remediation are fully revalidated.

## Objective

This plan completed the target state in the
[Step 4 public-facade adapter roadmap](step4.md) without changing the intended
CLI, HTTP, or public Go contracts.

The [accepted split decision](../adr/0002-split-promptkit-from-scriptorium.md)
owns the long-term Promptkit/Scriptorium boundary. The
[testing policy](../policy/testing.md) governs test value and ownership. The
[documentation policy](../policy/documentation.md) governs completion
bookkeeping and canonical ownership.

## Constraints

- Keep this work in the Scriptorium repository. Do not modify the sibling
  Promptkit repository or infer that Migration Step 5 is complete merely from
  its local presence.
- Preserve the public `ArtifactReader`, error sentinel, CLI, HTTP, containment,
  artifact-size, formatting, timeout, credential, and redaction contracts.
- Do not add compatibility shims, begin framework extraction, change the module
  path, or add dependencies.
- Keep tests deterministic, offline, independent of machine MIME databases,
  and focused at the narrowest stable owner.
- Preserve unrelated working-tree changes.

## Completed Work

The original implementation established the Step 4 boundary:

- the root facade now exposes `ArtifactReader` and `WithArtifactReader`, copies
  mutable artifact bodies, handles nil responses, and exposes the two specific
  public request-error identities required by HTTP;
- the restricted artifact reader and its containment and byte-limit policy now
  belong to the HTTP adapter and use public artifact types;
- prepared-run formatting and CLI `run` and `render` consume public prepared,
  request, and result values;
- the HTTP handler consumes a local interface expressed in public types, and
  CLI `serve` injects the restricted reader into the public engine;
- the legacy restricted framework reader was removed, current-behavior
  documentation was reconciled, and an initial dependency guard was added; and
- the initial validation pass covered the full suite, vet, build, race and
  repeated tests, maintained examples, configuration loading, links, and
  whitespace.

The post-implementation remediation is also complete:

- public error mapping retains collaborator identities while adding the active
  operation's public category;
- HTTP artifact MIME coverage uses a built-in media type while retaining the
  unknown-extension fallback check;
- the dependency guard recursively scans production adapter and formatter
  sources and rejects descendants of forbidden framework package families; and
- the final validation passed full and repeated tests, vet, a temporary-output
  build, race checks, maintained examples, both maintained configuration files,
  import and link inspection, and whitespace validation.