Migration Step 4 Implementation Plan

Status

Complete as of 2026-07-28. The public-facade adapter boundary and its post-implementation remediation are fully revalidated.

This plan completed the target state in the Step 4 public-facade adapter roadmap without changing the intended CLI, HTTP, or public Go contracts.

The accepted split decision owns the long-term Promptkit/Scriptorium boundary. The testing policy governs test value and ownership. The documentation policy governs completion bookkeeping and canonical ownership.

Keep this work in the Scriptorium repository. Do not modify the sibling Promptkit repository or infer that Migration Step 5 is complete merely from its local presence.
Preserve the public ArtifactReader, error sentinel, CLI, HTTP, containment, artifact-size, formatting, timeout, credential, and redaction contracts.
Do not add compatibility shims, begin framework extraction, change the module path, or add dependencies.
Keep tests deterministic, offline, independent of machine MIME databases, and focused at the narrowest stable owner.
Preserve unrelated working-tree changes.

The original implementation established the Step 4 boundary:

the root facade now exposes ArtifactReader and WithArtifactReader, copies mutable artifact bodies, handles nil responses, and exposes the two specific public request-error identities required by HTTP;
the restricted artifact reader and its containment and byte-limit policy now belong to the HTTP adapter and use public artifact types;
prepared-run formatting and CLI run and render consume public prepared, request, and result values;
the HTTP handler consumes a local interface expressed in public types, and CLI serve injects the restricted reader into the public engine;
the legacy restricted framework reader was removed, current-behavior documentation was reconciled, and an initial dependency guard was added; and
the initial validation pass covered the full suite, vet, build, race and repeated tests, maintained examples, configuration loading, links, and whitespace.

The post-implementation remediation is also complete:

public error mapping retains collaborator identities while adding the active operation's public category;
HTTP artifact MIME coverage uses a built-in media type while retaining the unknown-extension fallback check;
the dependency guard recursively scans production adapter and formatter sources and rejects descendants of forbidden framework package families; and
the final validation passed full and repeated tests, vet, a temporary-output build, race checks, maintained examples, both maintained configuration files, import and link inspection, and whitespace validation.