Consolidate assessment recommendations into remediation roadmap

2026-11-05 13:15:09 +00:00
parent 3ef2a9e18e
commit e85ea2db35
3 changed files with 380 additions and 960 deletions
--- a/docs/roadmap/audit-remediation.md
+++ b/docs/roadmap/audit-remediation.md
@@ -10,13 +10,20 @@ implementation plan; it is not that plan or a description of completed changes.
 Baseline: repository commit `bd3dfa9`, with the
 [audit catalog](audit/catalog.md) covering 41 source findings consolidated into
 34 remediation entries. All six catalog decisions have been accepted; their
-implementation remains pending. The catalog and supporting audits own finding
+implementation remains pending. The planning assessment was completed at
-evidence and decision rationale. This roadmap owns remediation organization,
+`3ef2a9e` against the unchanged production baseline, with evidence gathering
 starting at `21fea46`. Its recommendations, measurements, and subsequent review
 refinements are consolidated here; the separate assessment document is retired.
 The catalog and supporting audits own finding evidence and decision rationale. This roadmap owns remediation organization,
 dependencies, completion evidence, and subsequent workstream status. Earlier
 remediation suggestions in the source audits do not override accepted decisions.
-All workstreams below are pending. Catalog numbers are traceability identifiers,
+All workstreams below are pending implementation; their planning assessment is
-not a required implementation order or 34 separate delivery stages. The scope
+complete. No finding is proposed for deferral. Concrete designs below are the
 selected planning recommendations, not claims of tested replacement behavior.
 Private helper names are descriptive unless identifying an existing declaration.
 Catalog numbers are traceability identifiers, not a required implementation
 order or 34 separate delivery stages. The scope
 contains confirmed defects, documentation/test gaps, and maintainability work;
 those categories do not have equal urgency or automatically become release gates.
@@ -72,21 +79,35 @@ privacy and ownership boundaries remain applicable throughout.
 identified by the security audit. Toolchain selection and consumer compatibility
 must remain separate concerns.
-**Work:** Use the latest locally available Go installation for ordinary builds,
+**Assessed baseline:** Default `/snap/bin/go` reports 1.27.0. The assessment
-tests, and release validation. Update the local installation as needed for the
+found an executable Go 1.27.3 installation at
-identified fixes and repeat the focused assessment with the selected version.
+`/home/eric/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.27.3.linux-amd64/bin/go`;
-Make the ordinary-development instruction explicit in contributor guidance.
+other inspected installations were older. No installation is needed for the
-Follow the [release procedure](../release.md#prepare-the-candidate) and
+assessed environment. ConfigKit 1.1.0, jsonschema/v6 6.0.2, and ReleaseKit 0.9.0
-[consumer-minimum policy](../policy/release.md#consumer-minimum-and-release-toolchain):
+remain pinned. The focused version/applicability check found that 1.27.3 excludes
-normally declare the initial stable release of the selected series, advance the
+the affected ranges of GO-2026-6611 and GO-2026-6809 identified in the audit.
-series in minor releases, and retain the existing documented exceptions. Merely
+This was not a new full scan or an assessment of consumer binaries.
 selecting a newer patch for validation does not raise the consumer minimum.
-**Completion evidence:** Record the toolchain actually used and the focused
+**Selected work:** Put the newest available local Go binary directory first on
-reassessment outcome, distinguishing resolved findings from any remaining
+`PATH` and use `GOTOOLCHAIN=local` for ordinary builds, tests, and release
-applicability. This does not establish a new recurring scan gate. Advising
+validation. The existing ReleaseKit launcher already uses local selection.
-consumers about generally applicable Go vulnerabilities is outside PromptKit's
+Use the assessed 1.27.3 installation unless a newer local version is available
-responsibility; no such advisory work belongs in this roadmap.
+when implementation begins. Clarify this in contributor guidance. Assessment
 commands also used `GOWORK=off` for isolation; that is not a new restriction on
 consumer workspaces.
 Leave `go 1.27.0` unchanged for the assessed toolchain. Follow the
 [release procedure](../release.md#prepare-the-candidate) and
 [consumer-minimum policy](../policy/release.md#consumer-minimum-and-release-toolchain)
 for later series changes and existing exceptions. Selecting a newer validation
 patch does not itself raise the consumer minimum. Continuing with default
 1.27.0 is unnecessary given the installed fixed patch.
 **Completion evidence:** Record the actual validation toolchain and retain the
 focused reassessment above rather than repeating it without changed evidence.
 Local installation work is needed only if the selected installation becomes
 unavailable or new evidence calls for it. No recurring scan gate or consumer
 advisory about generally applicable Go vulnerabilities is introduced.
 ### B. Configuration And Schema Simplification
@@ -98,42 +119,70 @@ potentially exponential expansion. Schema validation loads external resources
 locally but sends only the root document to the provider. Compilation is
 repeated across direct/prepared and host-file/`fs.FS` paths.
-**Work:**
+**Selected source handoff:** Assign `config.ExtraParams` directly into the
 ordinary fields map in `ProfileSource` and `BackendSource`, then call
 `configkit.Mapping` as now. Optional typed fields and the `[]any` definition
 wrapper already use supported forms. Delete `provider_values.go` after replacing
 its two callers. ConfigKit's immediate snapshot and deferred unsupported/cyclic
 diagnostics make an extra shallow copy unnecessary. Do not add a replacement
 converter, precision checker, memoization, or raw-source validation pass.
-1. Remove the provider-value compatibility adapter from `ProfileSource` and
+**Selected schema design:** Retain source-specific root loading, then share
-   `BackendSource`, retaining ordinary field projection. Pass provider maps
+`compileSchemaDocument(ctx, resourceURL, document)` for compilation. Register
-   directly to ConfigKit `Mapping` for snapshotting and deferred diagnostics.
+the decoded root with `Compiler.AddResource`, retain the existing Draft2020
-   Callers supply supported built-in scalars, nil, `map[string]any`, and `[]any`
+selection, and use a context-aware loader that rejects requests for external
-   recursively. Do not replace the removed adapter with a precision checker,
+resources with an actionable error and no filesystem/network I/O. The compiler
-   pre-validation pass, or memoized converter.
+continues to own URI resolution, embedded IDs, anchors, and bundled metaschemas.
-2. Require self-contained schema documents. Continue loading the chosen root
+Send the self-contained root document to the provider unchanged in meaning.
-   schema from its configured source; reject references requiring another
+
-   document with an actionable preparation error. Preserve supported references
+The dependency probe found that unused `$defs` entries are not necessarily
-   within the document, including recursion where otherwise supported. Apply
+compiled with the root: a denying loader alone misses their external references.
-   the selected resource policy consistently across direct and prepared schema
+Enumerate schema locations with a small explicit table of schema-bearing
-   compilation without changing malformed-output short-circuiting into eager I/O.
+keyword positions supported by the pinned dependency, and compile those
-3. Simplify and share the remaining compilation lifecycle behind the needed
+locations through the same compiler/cache. Document the table's dependency
-   source adapters. Express the runner's preparation dependency in its internal
+relationship. Keep this a location traversal, not a second resolver or general
-   interface rather than discovering it through a runtime assertion. Preserve
+schema implementation. A lexical ban on non-fragment references would reject
-   source containment, cancellation, frozen plans, and existing validation
+valid embedded IDs; traversing arbitrary objects would mistake annotation data
-   semantics outside the selected external-resource removal.
+for schemas. Neither is selected.
-4. Cover `WithSchemaFile` through public construction and preparation/validation,
+
-   including option precedence and relevant file errors. Coordinate removal of
+Cover escaped JSON-pointer locations, annotation/example objects, embedded IDs,
-   its unused private helper result with workstream F.
+anchors, recursion, and dynamic references. Check embedded-resource dialect
 handling explicitly rather than assuming the root dialect governs every nested
 resource. Preserve existing supported dialect behavior; do not use this walk to
 introduce broader dialect support or new restrictions. The probe recipe and
 observed results are retained under [planning evidence](#planning-evidence).
 Direct validation invokes shared compilation only after instance decoding;
 prepared validation compiles eagerly as before. Remove external-resource loaders,
 not root containment/read helpers. Change runner fields/constructor parameters
 and the internal engine Options validator slot to `validate.ValidationPreparer`.
 Return concrete validator pointer types from internal constructors so direct
 `Validate` and preparation callers both compile. Preserve nil-validator no-op,
 nil-plan error, cancellation, and frozen-plan behavior. No public facade
 signature change is required.
 Cover `WithSchemaFile` through public construction and preparation/validation,
 including source replacement/precedence and relevant file errors. Coordinate
 removal of its unused private helper result with F. Replace external-resource
 success fixtures with early-error cases, retaining independent root-source tests.
 **Completion evidence:** Focused source-helper cases demonstrate supported-value
 handoff, immediate source capture, and ConfigKit's deferred unsupported/cyclic
 value diagnostics. Include formerly converted input forms to demonstrate the
-migration boundary; do not duplicate ConfigKit's entire limit suite. Schema
+migration boundary: nested built-in maps/lists, mutation after source creation,
-cases establish external-reference rejection before provider dispatch, retained
+and representative `json.Number`, named scalar/typed container, pointer, and
-in-document references, and an outbound self-contained constraint usable without
+cyclic inputs for both helpers. Keep optional-field and construction-order
-other local files. Retain independent source-path and direct/prepared coverage.
+coverage; do not duplicate ConfigKit's entire limit suite. Schema cases establish external-reference rejection before provider dispatch, retained
 in-document references, unused external-definition rejection, and an outbound
 self-contained constraint usable without other local files. Retain independent source-path and direct/prepared coverage.
 These checks establish packaging completeness, not universal provider support.
 **Compatibility:** Explain caller conversion of `json.Number`, named scalars,
 typed containers, arrays, and nested pointers into ConfigKit-supported forms.
-Explain removal of external schema loading. No arbitrary-precision promise or
+For example, replace `[]string` with `[]any` containing strings; callers choose
-change to runtime request overrides accompanies this simplification.
+and check numeric conversion themselves. Explain removal of external schema
 loading. No arbitrary-precision promise or change to runtime request overrides
 accompanies this simplification.
 ### C. Ownership, Errors, And Diagnostic Evidence
@@ -154,38 +203,83 @@ and successful authentication responses are read without a byte bound.
 2. Preserve the owning public error category independently of nested causes,
   retaining appropriate `errors.Is`/`errors.As` access. Do not require category
   exclusivity: retained causes can make more than one category match. Preserve
-   meaningful direct-not-found versus load-failure distinctions.
+   meaningful direct-not-found versus load-failure distinctions. Use a small
   internal operation error carrying category/cause with `Unwrap`/`Is` behavior.
   Apply it at owning boundaries and select its category in facade translation,
   including before nested capacity/provider/exhaustion projections can obscure
   it. Preserve those specialized public projections and matchable child causes.
   Reordering a whole-chain sentinel switch cannot express operation ownership.
 3. Distinguish successful-response body I/O failures from malformed JSON at both
   initial decoding and end verification. Preserve the redacted transport
   boundary, cancellation precedence, and genuine malformed, truncated, or
-   oversized-content behavior without adding retries.
+   oversized-content behavior without adding retries. Record actual non-EOF
   reader errors beneath the existing limited reader. On decode/end-check
   failure, prefer observed context errors, retain size-overflow classification,
   and otherwise propagate recorded I/O failures through `requestFailedError`.
   Distinguish reader-returned errors from parser-generated syntax/type/truncation
   errors, rather than treating every `io.ErrUnexpectedEOF` alike.
 4. Return local inference-diagnostic construction failures as `ErrInvalidRequest`
   using explicit preparation-stage information. Preserve completed diagnostics
   for missing credentials, capacity outcomes, and unsupported/inapplicable
   operations; absence of dispatch alone does not imply an invalid request.
   Add internal `GenerationEvidence.PreparationFailed bool`, set only at the
   built-in `PrepareGeneration` failure return. Diagnostic orchestration checks
   it after caller cancellation. Injected-client errors retain their established
   semantics; no new public stage field is needed.
 5. Define the authentication response allowance as a named internal constant of
   1 MiB (1,048,576 bytes). Enforce against actual reads regardless of declared
   length, detect overflow, and close without unbounded draining. Report an
   explicit limit diagnostic with credential acceptance unknown and retain
-   available HTTP status/timing. Choose its concrete report representation
+   available HTTP status/timing. Add matching public/domain reason constants
-   during implementation design; overflow is not malformed JSON or credential
+   `SmokeTestReasonAuthenticationResponseLimitExceeded` with value
-   rejection. No public configuration knob is added now.
+   `authentication_response_limit_exceeded`. For HTTP 200 recognition overflow,
   use existing `ExecutionFailureOther`, nil `CredentialsAccepted`, and a
   completed report with nil Go error unless caller cancellation applies.
   No new report field, failure enum, or public budget knob is needed.
   Read at most allowance plus one byte using `io.LimitReader`/`io.ReadAll`;
   check overflow before JSON recognition. Preserve 401 rejection without body
   consumption and other non-200 behavior independently of unused bodies.
 6. Move OpenRouter-specific authentication request/response interpretation into
   the outbound adapter. Leave selection, applicability, completion, and neutral
   reporting in the use case. Preserve anonymous probing and credential/body
   privacy. Narrow smoke copying to actual consumers, removing unused request
   cloning and replacing full-report cloning used only to detach a target.
   Use an `internal/llm` authentication operation returning HTTP evidence,
   optional acceptance, overflow/unrecognized indicators, and operational error;
   the use case maps those facts to report outcomes. Move default endpoint
   derivation to an llm helper used by selection, retaining explicit overrides.
   Consume a narrow authentication capability alongside reachability HTTP,
   without reverse dependencies or a plugin registry. Directly detach the
   target/provider map; retain facade and active-backend copying.
 7. Exercise `RunRequest`'s privacy formatting and JSON omission boundary with
-   synthetic markers and the relevant value/pointer forms.
+   synthetic markers in omitted variables, bodies, and execution settings, not
   IDs deliberately present in summaries. Cover `%v`, `%+v`, `%#v`, direct
   String/GoString, value/pointer forms, and direct-key JSON omission.
 **Completion evidence:** Focused concurrent artifact tests follow the selected
 ownership contract; they do not promise safety for readers that violate it.
 Offline regressions cover composed public causes, both response read-failure
 locations, construction failures with no dispatch, and authentication boundary
-and overflow cases including missing/inaccurate lengths. Assert diagnostic facts
+and overflow cases including exact limit/limit-plus-one, missing/inaccurate
-and privacy rather than complete incidental serialized shapes. Preserve active
+lengths, closure without draining, 401 without consumption, context interruption,
 and redaction. Update reason GoDoc and public conversion with the bound. Assert
 diagnostic facts and privacy rather than complete incidental serialized shapes. Preserve active
 backend copying, facade projection, and provider-map error behavior.
 The public-boundary outcome matrix for planning is:
 | Case | Owning outcome | Evidence preserved |
 | --- | --- | --- |
 | Client returns a child missing-prompt error | `ErrLLMGenerate` | Matchable child cause/category. |
 | Reader returns that child error | `ErrArtifactLoad` | Matchable child cause/category. |
 | Direct missing prompt/profile | Existing not-found error | No generic load-error substitution. |
 | 2xx body I/O error at either decode stage | Generation/transport failure | Original read cause with redacted formatting. |
 | Parser-invalid/truncated JSON, extra value, inference size overflow | Existing malformed-response behavior | No additional retry or parser-detail disclosure. |
 | Built-in diagnostic preparation failure | `ErrInvalidRequest`, not a completed report | Zero dispatch and preparation cause. |
 | Missing required credential or capacity outcome | Existing completed diagnostic | No inferred construction failure. |
 | Authentication recognition overflow | Explicit limit reason; acceptance unknown | HTTP/timing facts, not secret-bearing response data. |
 | Caller cancellation | Existing cancellation precedence | No publication of success over cancellation. |
 **Dependencies:** The authentication bound can land before protocol relocation;
 cleanup must not delay the defect remedy. Correct error/stage behavior before
 restructuring generation accounting in E.
@@ -199,24 +293,62 @@ unneeded backing storage or engine ownership, serialize unbounded diagnostic
 text before truncation, reclone overlay descendants, and scan complete catalogs
 for namespace-filtered listings.
-**Work and completion evidence:**
+**Selected remedies and completion evidence:**
-| Area | Intended remedy | Evidence and limits |
+- **Requirement evidence (10):** Intermediate missing-name sets are owned by
-| --- | --- | --- |
+  their evaluation results. Merge the smaller set into the larger, transfer nil
-| Requirement evidence (10) | Accumulate or merge evidence without repeatedly copying growing sets. | Exercise representative left-heavy conditions; preserve classification and conservative coverage without new expression limits. |
+  sets directly, and combine flags as now. Operands subsequently read values and
-| Prepared handles (16) | Prefer a small standalone ownership identity that does not retain the runner graph. | Preserve foreign-owner checks, one-time claim, namespace-view behavior, details, and concurrent claim/discard behavior. Identity cannot rely on distinct zero-sized allocations comparing unequal. |
+  known flags, not independent evidence snapshots. This avoids repeated growing
-| Repair feedback (17) | Encode bounded feedback incrementally rather than fully serializing then truncating. | Preserve output semantics, stored diagnostics, and previous candidate; measure large and heavily escaped diagnostics. No exact peak-heap guarantee or new input limit. |
+  copies without a global accumulator that could mix branch-local evidence.
-| Session IDs (18) | Detach the accepted normalized string from a larger caller allocation. | Preserve trimming, content/code-point validation, wire values, and hashes; no raw-input restriction. |
+  Preserve union/flag outcomes and conservative inspection coverage with
-| Provider overlays (19) | Avoid repeated descendant cloning while preserving owned results. | Compare representative nested overlays and preserve recursive-map, null, array, and isolation behavior. |
+  representative left-heavy cases and independent renderer comparisons.
-| Namespace listings (20) | Capture buckets or ranges to query the relevant inventory subset. | Evaluate sparse/absent matches, ordering, exact identity, cancellation, caller-owned results, and construction/retained-memory cost. |
+- **Prepared handles (16):** Replace `owner *Runner` with a pointer to an immutable,
  non-zero-sized private identity object allocated once per runner constructor.
  Keep the token after claim/discard so foreign-owner checks retain their order
  without retaining the runner graph or adding mutable owner-field races.
  Retain mutex-protected state transitions/payload clearing and detached details.
  Cover foreign owners, namespace views, concurrent claim/discard, one-shot use,
  and details after use/discard. A GC-timing assertion is unnecessary.
 - **Repair feedback (17):** Attempt bounded construction of the complete-list
  result; if it cannot fit, construct the omission form with existing order and
  reservation rules. Normalize only potentially useful prefixes, preserving
  `strings.ToValidUTF8` behavior for invalid-byte runs and rune-safe truncation.
  Use standard `json.Marshal` on bounded normalized strings and existing prefix
  selection rather than a custom escaper. A limited writer around `json.Encoder`
  does not suffice if encoding first allocates the whole original string.
  Preserve the 64 KiB output rule, omission marker, valid JSON, HTML/control
  escaping, Unicode, complete stored diagnostics, and previous candidate.
  Cover fitting/exact-boundary/oversized/many-entry/escaped/invalid inputs.
 - **Session IDs (18):** Apply `strings.Clone` to the validated nonempty normalized
  value before returning from `NormalizeSessionID`. Preserve trimming, Unicode,
  accepted content, and wire/hash values without adding a raw-input limit.
 - **Provider overlays (19):** Clone the lower map once, then recurse into owned
  descendants for overlapping built-in maps and copy only upper replacements.
  Preserve null/array replacement, accepted types, error boundaries, and input
  isolation. This directly removes the repeated descendant cloning measured in
  the assessment without an index or framework.
 - **Namespace listings (20):** Resolve scope in the engine, then pass private
  `configuration.IdentityFilter{All bool, Namespace string}` to captured
  inventories. All copies the sorted slice once; named selection binary-searches
  the exact `namespace + "/"` prefix range and copies only matches. Unqualified
  selection scans immutable state directly, without first copying everything.
  Update the private inventory interface/fakes for backend/profile IDs and
  prompt identities. Preserve final context checks, ordering, exact prefix
  matching, absent results, view/default/All scope, and mutation isolation.
-Measurements guide proportionate remedies, particularly for 17, 19, and 20;
+Existing sorted inventories supply named ranges without persistent buckets or
-they are not new performance contracts, benchmark thresholds, or recurring
+extra construction traversal. Buckets could reduce repeated lookup work but add
-release gates. If a proposed optimization's benefit does not justify its
+retained state even for consumers that never list resources. Unqualified entries
-complexity, record the evidence and an explicit disposition rather than silently
+need not form a contiguous range; their selection remains a scan. No new public
-marking it implemented. Do not broaden the remediation merely to improve a
+signature, cache, pagination, or complexity guarantee accompanies this remedy.
-synthetic benchmark. Coordinate evidence accumulation with E's traversal work
+
-and overlays with E's compatible-copying work.
+The [baseline measurements](#planning-evidence) support implementing 17, 19, and
 20 rather than deferring them. Repeat comparable cases after implementation;
 expected savings and algorithmic estimates are not measured replacement results.
 No exact peak-heap promise, benchmark threshold, or recurring release gate is
 introduced. If new evidence changes the tradeoff, record it and the proposed
 disposition rather than silently dropping selected work. Coordinate evidence
 accumulation with E's traversal work and overlays with E's trusted copying.
 ### E. Internal Coordination And Test Assembly
@@ -231,23 +363,44 @@ capacity wrapper remains a production constructor.
 - Extract focused configuration validation/materialization helpers with visible
  inputs and ownership. Preserve final-handoff validation, presence/null rules,
  origins, and meaningful error precedence without pinning incidental ordering
-  of independent failures.
+  of independent failures. Keep `validateEffective`'s resource/index traversal
  visible and extract backend/profile/prompt validators with record/path/index
  inputs. Keep typed presence interpretation together in profile construction.
  Split prompt capture into input/metadata projection, message content/template
  capture, and output-contract conversion; retain lazy origins, source-relative
  reads, and one final inspection/hash assembly.
 - Separate requirement recognition/evaluation from reachability and evidence
  bookkeeping, sharing `if`/`with` orchestration where appropriate. Preserve
  scope differences, inactive computed-name behavior, and independent comparison
-  with the actual renderer. This does not expand inspection into an interpreter.
+  with the actual renderer. Share the existing `parse.BranchNode` protocol,
  handling With's changed body dot and unchanged else dot explicitly. Preserve
  known/skipped/unknown classification and limitation bookkeeping; no generic
  visitor or additional template syntax is needed.
 - Consolidate structural copying only where policies genuinely agree. Keep
  facade projection and runtime validation distinct; preserve existing types,
  nils, supported numbers, schema keys, and ownership. Infallible projection
-  must not acquire new errors or silent fallbacks. Retain small separate walkers
+  must not acquire new errors, panics, or silent fallbacks. Retain separate walkers
  if sharing would require a configurable reflection framework. B's removed
  source compatibility adapter must not migrate into this shared machinery.
  Put infallible cloning in `internal/jsonvalue.CloneTrusted(any) any` and route
  facade nested values through it. Runtime `Copy`/`CopyMap` validate, normalize
  indirection/null, and enforce limits/key policy; trusted cloning preserves
  accepted values and existing fast-path/reflection type/nil behavior without
  interpreting numbers. Do not substitute fallible `Copy` and hide errors.
  This centralizes ownership, not necessarily the traversal algorithm: two small
  walkers remain appropriate where their policies differ.
 - Separate generation attempt results and accounting from dispatch/retry control
  flow with small internal helpers. Preserve built-in/injected differences,
  permit release before callbacks or backoff, frozen requests, existing retry
  classification, private evidence, and known/unknown usage distinctions.
  Replace execute's parallel returns with `attemptResult` containing
  `Outcome llm.AttemptOutcome`, `Dispatched`, `CapacityWait`, `RequestDuration`,
  and `StartedAt`. Share usage/evidence/event projections only where facts match;
  built-in retry and injected one-shot control flow remain distinct. C's
  preparation-failure marker is independent of attempt accounting.
 - Move the initial/repair runner scheduling test to the production generation
-  coordinator, then remove the legacy capacity client wrapper. Preserve useful
+  coordinator via `generation.NewInjected` with the same manager, then remove
  `internal/capacity/client.go` and its retention prose. Preserve useful
  FIFO, cancellation, independent-pool, and panic-release scenarios with their
  owning components. Keep any useful one-shot scaffolding test-only; do not wrap
  the coordinator in another permit-acquisition layer.
@@ -274,17 +427,26 @@ are duplicated or over-specified, and internal fields/helpers have no consumer.
  replacement. Remove stale trimmed-ID and prompt-version comments.
 - Give complete bundled-catalog expectations one independently specified test
  owner. Retain smaller tests for distinct loading, wire, and smoke behavior,
-  using controlled fixtures where bundled content is irrelevant.
+  using controlled fixtures where bundled content is irrelevant. Keep the full
  independent oracle in `internal/configuration/bundled_test.go` and replace its
  formatted-map plugin comparisons with structural assertions. Public tests own
  toggles/order/isolation/overrides; use a controlled model/plugin wire case and
  a configured-default smoke case instead of repeating the complete matrix.
 - Replace literal artifact-hash algorithm assertions with documented opaque
  equality/ownership and byte/size behavior; keep benchmark setup outside timed
-  work. This does not require changing the artifact hash algorithm.
+  work. Use same-body inline/file equality for size-hint cases and prepare an
  opaque expected hash outside benchmark timing. This does not require changing
  the artifact hash algorithm.
 - Remove unused backend presence records and `QueueCapacitySet`, preserving
  effective queue defaults, explicit zero, provenance, and needed profile/input
-  presence tracking.
+  presence tracking. Remove the unused backend field list/map, resolution capture,
  and runtime queue-presence flag, not ConfigKit provenance.
 - Remove duplicated captured prompt output-format and unused message-file fields.
  Preserve actual `content_file` loading, origins, and override-default behavior.
  Account for observable definition-hash changes without promising permanent
-  encoding or bit-identical hashes across this change.
+  encoding or bit-identical hashes across this change. Remove the unreachable
  fallback with the fields, preserving empty-format request defaulting and
  inspection/preparation equality.
 - Remove unused private reachability endpoint state and the unused schema-helper
  result, preserving actual report evidence and public single-file behavior.
  Remove orphan `filecatalog.RelativePath`, `resourceNamespaceFromID`, and the
@@ -319,9 +481,10 @@ letters group outcomes; they are not mandatory serial phases.
 The later plan should assign concrete implementation units, validation, and
 status to these outcomes. No significant product decisions remain open now.
-Report representation, helper extraction boundaries, and index layout remain
+The assessment has selected report representation, extraction boundaries, and
-ordinary implementation choices within the selected behavior. Escalate only
+listing layout as described above. Exact private names and equivalent coding
-new evidence requiring a contract or scope change.
+details remain implementation choices. Escalate new evidence requiring a
 contract or scope change; do not reopen resolved choices without such evidence.
 ## Compatibility And Documentation Delivery
@@ -340,6 +503,138 @@ behavior lands. Clarify ordinary development toolchain selection in
 [development guidance](../development.md), linking to existing release policy.
 Correct standalone documentation defects without waiting for unrelated code.
 ## Planning Evidence
 These are historical assessment results from unchanged production code at the
 baseline above, using Go 1.27.3 on linux/amd64, Intel i5-7260U. Assessment records
 were completed in commit `3ef2a9e`. Dependency/source inspection supplied the
 ownership, caller, and interface evidence; temporary offline probes supplied the
 schema results and measurements below. No replacement implementation was built
 or benchmarked. Aggregate allocation is not peak live heap, and noisy timings
 are not throughput promises.
 The temporary harness directory was `/tmp/promptkit-assessment-aqn3B8`. Its
 continued existence is not a planning dependency: the reproduction recipes below
 retain the workloads and invocation settings. Recreate targeted harnesses outside
 the repository or carry equivalent cases into focused implementation benchmarks,
 not a new permanent benchmark framework. Reuse unchanged evidence unless a
 changed dependency, workload, or implementation makes a new measurement useful.
 ### Schema Dependency Probe
 With jsonschema/v6 6.0.2, decode each document with `json.Decoder.UseNumber`,
 create a fresh compiler with `DefaultDraft(Draft2020)`, register the document at
 `https://example.invalid/retrieval`, and install a loader that counts requests
 and returns an external-resource error. Compile the retrieval URI; for the
 unused-definition case, additionally compile `#/$defs/unused` with the same
 compiler. The harness used `go run -mod=readonly` with
 `GOTOOLCHAIN=local GOWORK=off GOPROXY=off`; no network resources were fetched.
 | Document case | Root compilation | External loads |
 | --- | --- | --- |
 | `$defs.v` string schema referenced by `#/$defs/v` | Succeeds | 0 |
 | `$anchor: v` in a definition, referenced by `#v` | Succeeds | 0 |
 | Object definition with `next` referring recursively to that definition | Succeeds | 0 |
 | Explicit absolute root ID and reference to its definition through that ID | Succeeds | 0 |
 | Embedded definition with relative `$id: child`, referenced as `child` | Succeeds | 0 |
 | Root `$ref: child.json` with no embedded resource | Fails | 1 |
 | Root string schema with unused `$defs.unused: {$ref: child.json}` | Succeeds; explicitly compiling the definition fails | 0, then 1 |
 | Example instance object containing literal `$ref: child.json` | Succeeds | 0 |
 | Standard 2020-12 `$schema` declaration | Succeeds | 0 |
 Explicit-ID cases also worked when retrieval URI and document ID differed. A
 review rerun reproduced these results. This supports B's rejecting loader plus
 schema-location enumeration, not a lexical URI ban. Dynamic references, escaped
 pointers, embedded dialect handling, and full location-table coverage remain
 implementation regression cases, not claims established by this small probe.
 ### Overlay Baseline
 Construct maps outside timing. Start with
 `map[string]any{"leaf": 1, "array": []any{1, 2, "x"}}`; wrap it `depth` times in a map with
 `child` pointing to the previous level and `width` scalar keys named `key0`,
 `key1`, etc., each with its index value. Build lower and upper independently.
 For the disjoint case, wrap upper once more under `new`; otherwise use matching
 keys. Call unchanged `overlayProviderMap`, retaining its result and checking
 errors. These are chains with scalar siblings, not exponentially branching trees.
 Run a temporary test overlay in `internal/configuration`, substituting its
 absolute JSON mapping path:
 ```sh
 go test -mod=readonly -overlay=/absolute/path/overlay.json ./internal/configuration \
  -run '^$' -bench '^BenchmarkAssessmentOverlay$' \
  -cpu=1 -benchmem -benchtime=50x -count=3
 ```
 The overlay maps an absolute package-local test filename to an external harness
 file declaring that package; it does not edit repository source. The same
 `GOTOOLCHAIN=local GOWORK=off GOPROXY=off` settings apply to all measurements.
 | Depth / width / overlap | Observed ns/op range | B/op | Allocs/op |
 | --- | --- | --- | --- |
 | 2 / 2 / overlapping | 20,104–34,618 | 9,496 | 236 |
 | 12 / 2 / overlapping | 263,387–287,814 | 117,869 | 2,609 |
 | 40 / 2 / overlapping | 2,355,659–2,580,220 | about 1,241,620 | about 22,672 |
 | 4 / 16 / overlapping | 168,483–178,889 | 65,434 | 1,591 |
 | 12 / 2 / disjoint upper root | 49,437–53,966 | 32,496 | 686 |
 Source inspection shows lower descendants cloned again at each recursive
 overlap. The selected owned-overlay algorithm removes that repeated work;
 post-change measurements must establish actual savings.
 ### Repair Feedback Baseline
 Call unchanged `formatRepairDiagnostics` with one-element string slices:
 64 ASCII `x` bytes, 1 MiB of `x`, and 1 MiB of repeated `<&>` plus NUL (four bytes
 per repetition). Build inputs outside timing, retain the output in a sink, and
 record input/output lengths after stopping timing. Use the overlay method above
 in `internal/usecase`, benchmark `BenchmarkAssessmentFeedback`, with
 `-cpu=1 -benchmem -benchtime=20x -count=3`.
 | Input | Observed time per operation | Allocated bytes per operation | Output bytes |
 | --- | --- | --- | --- |
 | 64 ASCII bytes | 780–1,198 ns | 224 | 68 |
 | 1 MiB ASCII | 5.83–7.99 ms | about 6.81 MB | 65,536 |
 | 1 MiB escaped content | 27.7–39.1 ms | about 44.12 MB | 65,531 |
 Full-string normalization and repeated full marshaling account for the observed
 allocation scale. D's bounded-prefix design must preserve the existing fitting
 result and omission semantics; these timings do not measure the new design.
 ### Listing Baseline
 For N = 32, 1,024, and 4,096, create sorted IDs `namespace/p%06d` outside timing.
 Sparse mode assigns one ID to `target`; dense assigns half. Other IDs use `other`.
 All mode uses the sparse inventory with the All filter; absent mode selects
 `missing`. The baseline list callback returns `append([]string(nil), ids...)`,
 matching configuration's full-inventory copy. Invoke unchanged
 `filterIdentityList` with background context and empty view namespace. Use an
 `internal/engine` overlay, `BenchmarkAssessmentListing`, and
 `-cpu=1 -benchmem -benchtime=100x -count=3`.
 | Total IDs | Mode order | ns/op ranges in mode order | B/op | Allocs/op |
 | --- | --- | --- | --- | --- |
 | 32 | All / sparse / dense / absent | 1,176–1,332 / 759–937 / 1,053–1,875 / 797–819 | 1,472 / 528 / 960 / 512 | 5 / 2 / 4 / 1 |
 | 1,024 | All / sparse / dense / absent | 41,851–48,965 / 13,860–19,334 / 38,416–45,031 / 15,258–19,282 | 78,144 / 18,448 / 37,184 / 18,432 | 11 / 2 / 9 / 1 |
 | 4,096 | All / sparse / dense / absent | 194,479–202,439 / 92,265–95,215 / 148,209–151,180 / 93,157–94,526 | 305,472 / 65,552 / 166,208 / 65,536 | 14 / 2 / 12 / 1 |
 This measures filtering/copying, not full construction or public projection.
 For post-change comparisons, exercise D's selection-before-copy path rather than
 retaining an artificial full-copy callback. Repeated requests repeat the
 baseline full-inventory allocation. Binary search over existing named ranges
 has estimated comparison work proportional to log N plus output and introduces
 no persistent index; no alternative layout was benchmarked.
 ### Requirement Evidence Work Count
 For a left-heavy recognized condition with N distinct missing names, the current
 merge copies growing sets: `2 + 3 + ... + N` insertions, excluding leaf creation.
 That is 9 at N=4, 135 at N=16, and 8,255 at N=128; the ordinary two-name case
 needs two. These are source-derived counts, not elapsed-time measurements. The
 selected small-to-large owned merge addresses that specific repeated copying;
 it does not establish a universal inspection complexity contract.
 ## Validation And Completion
 Follow the [testing policy](../policy/testing.md) and existing
--- a/docs/roadmap/audit/catalog.md
+++ b/docs/roadmap/audit/catalog.md
@@ -14,6 +14,11 @@ into a release gate. The source audits retain their evidence, qualifications,
 and validation results. None of these entries is marked remediated by this
 documentation-only consolidation.
 The [audit remediation roadmap](../audit-remediation.md) owns the consolidated
 implementation-planning recommendations, evidence-dependent design choices,
 sequencing, and workstream status. This catalog remains the finding/evidence
 index and record of the six accepted decisions.
 ## 1. Update The Audited Maintainer Toolchain For Applicable Security Fixes
 **Conditional security exposure.** The audited Go 1.27.0 toolchain predates
--- a/docs/roadmap/planning-assessment.md
+++ b/docs/roadmap/planning-assessment.md
@@ -1,880 +0,0 @@
 # Audit Remediation Planning Assessment
 ## Purpose And Authority
 Work through the unresolved design and evidence-dependent choices in the
 [audit remediation roadmap](audit-remediation.md) before writing its staged
 implementation plan. Each numbered topic below is an assessment unit: gather
 the stated evidence, compare viable approaches, and record a recommendation
 before proceeding to the next topic.
 The [catalog's six accepted decisions](audit/catalog.md#resolved-decisions)
 remain authoritative. This assessment selects ways to implement those decisions;
 it does not reopen them or repeat the repository-wide audits. Catalog numbers
 below identify the relevant findings, not additional implementation stages.
 Assessment started on 2026-11-05 at clean commit
 `21fea46fb3b0ce9483db2399c9587f4a2323d687`. Assessment records below distinguish
 completed analysis from still-pending implementation.
 ## Assessment Method And Outputs
 Read the [contributor guide](../development.md) and applicable policies before
 each topic. Reuse existing audit evidence, source inspection, and successful
 checks where sufficient. Prefer graph discovery for callers and dependencies,
 then inspect the relevant code, contracts, and tests. Follow the
 [configuration-boundary ADR](../adr/0001-configuration-boundary.md).
 This is analysis, not remediation. Do not change production code, dependencies,
 installed toolchains, public contracts, or repository tests during the
 assessment. No prototype or alternative implementation is needed. Use existing
 offline benchmarks and tools where helpful; temporary measurement harnesses
 outside the repository are appropriate only when needed to answer a specific
 question. Record their setup sufficiently to interpret or repeat the results.
 Do not use live inference, credentials, or private production data.
 Append an assessment record beneath each completed topic containing:
 - **Evidence:** repository commit, concrete declarations/callers/tests, relevant
  dependency version, and measurements or commands actually used.
 - **Alternatives:** plausible approaches and their semantic, maintenance, and
  resource tradeoffs. Do not manufacture alternatives to an obvious correction.
 - **Recommendation:** the selected design or a justified proposed deferral,
  affected boundaries, and reasoning. Distinguish observed results from inference.
 - **Plan handoff:** consequential signatures, fields, algorithms, or ownership
  transitions to specify; dependencies; migration/documentation impact; and
  implementation-time validation needed.
 - **Status:** assessed, or a specific remaining uncertainty and the next bounded
  investigation needed. Assessment completion does not mean remediation complete.
 For measurements, record the selected Go version, workload size/shape, and the
 relevant time, allocations, bytes, or retention evidence. Use small ordinary
 cases and larger valid cases to distinguish fixed overhead from scaling.
 Repeat noisy measurements only as needed; do not introduce benchmark thresholds,
 a generalized benchmark project, or a recurring release gate. Code-based work
 counts can establish avoidable traversal without timing every helper. Do not
 present estimated improvements as measured results from unimplemented code.
 Recommendations should settle consequential implementation choices, not private
 helper names or equivalent coding details. Proceed between topics without new
 human-review or publication gates. If evidence requires changing an accepted
 decision or broadening scope, identify that question for the maintainer rather
 than silently selecting a new contract.
 ## 1. Establish The Evidence And Toolchain Baseline
 **Catalog:** 1; applies to subsequent measurements.
 Collect the current commit and worktree state, dependency versions, available
 Go installations, and the effective toolchain used by existing development and
 release commands. Compare the selected local toolchain against the specific
 networking fixes identified in the security audit, using authoritative upstream
 information where needed. Distinguish library/client applicability from server
 or platform-only findings and uncertainty about downstream builds.
 Recommend the toolchain to use and any environment update needed before
 remediation validation. Record an unavailable patched toolchain as environment
 work to schedule, not permission to install one during assessment or to stop
 independent source analysis. Retain the accepted separation between maintainer
 selection and consumer minimum; do not add consumer advisories or scan gates.
 ### Assessment Record
 **Status:** Assessed; no environment installation is needed.
 **Evidence:** Default `/snap/bin/go` reports Go 1.27.0, but the existing module
 cache contains executable Go 1.27.3 at
 `/home/eric/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.27.3.linux-amd64/bin/go`;
 invoking it reports `go1.27.3 linux/amd64`. Other inspected SDK/cache installs
 are older. `go.mod` declares 1.27.0, ConfigKit 1.1.0, jsonschema/v6 6.0.2, and
 ReleaseKit 0.9.0. `scripts/releasekit.sh` sets `GOTOOLCHAIN=local`, so its
 toolchain is selected by `PATH`, not automatically upgraded.
 **Recommendation and alternatives:** Put the existing 1.27.3 binary directory
 first on `PATH`, with `GOTOOLCHAIN=local` and `GOWORK=off`, for subsequent
 assessment commands and implementation validation. The authoritative affected
 ranges for [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) and
 [GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809) exclude 1.27.3: the two
 specific audited exposures are addressed by that selection. This is a focused
 version/applicability reassessment, not a new full vulnerability scan or a claim
 about consumer binaries. Continuing with default 1.27.0 retains the identified
 exposure and is not recommended; installation is unnecessary.
 **Plan handoff:** Clarify ordinary development toolchain selection in
 `docs/development.md`; leave `go 1.27.0` unchanged. Record the actually selected
 patch when validating remediation. No consumer advisory or recurring scan gate.
 ## 2. Specify Direct ConfigKit Source Handoff
 **Catalog:** 3, 5; informs 24.
 Inspect the pinned ConfigKit `Mapping` contract and implementation at the
 snapshot/error boundary, plus both PromptKit convenience helpers and their
 callers. Establish which ordinary field projections remain, when values are
 captured, and how unsupported values, cycles, and shared graphs reach deferred
 diagnostics. Inventory existing fixtures using formerly converted types.
 Recommend the exact removal boundary for the compatibility converter, supported
 handoff cases, and migration examples. Identify which current tests remain
 meaningful and which assert intentionally removed accommodation. Do not design
 a replacement converter, pre-validation pass, or upstream feature. Existing
 upstream ownership evidence is sufficient; exhaustive ConfigKit limit testing
 is not an assessment deliverable.
 ### Assessment Record
 **Status:** Assessed; remove the compatibility adapter without replacement.
 **Evidence:** `ProfileSource` (`profiles.go:29`) and `BackendSource`
 (`backends.go:82`) already project optional typed fields into built-in values
 and wrap definitions in `[]any`. Their only recursive compatibility dependency
 is `providerMapForMapping(config.ExtraParams)`. The pinned ConfigKit 1.1.0
 `source.go:Mapping` promises immediate capture and deferred unsupported/cyclic
 diagnostics. Its `internal/engine/source.go:Mapping` builds an owned document
 and retains `mapIssue`; `readSource` reports it when consumed. PromptKit's
 `provider_values.go` instead expands maps/slices before that bounded handoff
 and parses `json.Number` through a lossy float fallback. Existing
 `sources_contract_test.go` mainly protects flat-map ownership, not this broader
 input boundary.
 **Recommendation and alternatives:** Assign `config.ExtraParams` directly into
 the ordinary fields map in both helpers, then call `configkit.Mapping` as now.
 Delete `provider_values.go` after its two callers are replaced. A shallow map
 copy adds no capture protection beyond Mapping; another recursive converter or
 raw validation would retain the responsibility being removed. Runtime overrides
 continue using their separate JSON-value boundary.
 **Plan handoff:** Cover both helpers with nested built-in maps/`[]any`, mutation
 after source creation, and deferred failures for representative `json.Number`,
 named scalar/typed container, pointer, and cyclic inputs. Keep construction
 order/optional-field coverage. Explain caller conversion to supported forms:
 for example, `[]string` becomes `[]any` of strings; callers choose and check
 numeric conversion themselves. Do not assert preserved numeric spelling or
 duplicate ConfigKit's entire resource-limit suite. Source-helper GoDoc and
 migration notes own the changed accepted-value boundary.
 ## 3. Specify Self-Contained Schema Resolution And Compilation
 **Catalog:** 6, 15, 21; coordinates with 32.
 Inspect the pinned schema compiler's resource registration/loading facilities,
 the four direct/prepared and host-file/`fs.FS` paths, native-schema projection,
 and runner validation interfaces. Establish where root loading, reference
 resolution, compilation, cancellation, and malformed-output short-circuiting
 occur.
 Use a compact semantic case inventory to distinguish references resolved inside
 the supplied document from references needing another document. Include local
 fragments, anchors, recursion, and supported identifiers/base-URI behavior;
 preserve existing dialect support rather than adding it. Do not equate an
 external-looking reference string with external resource loading without
 checking resolution semantics.
 Recommend the shared compilation boundary, needed source adapters and internal
 interface signatures, and external-resource rejection/error path. Identify
 obsolete loaders/tests and retained containment, single-file, freezing, and
 direct-validation cases. Specify how the provider receives the self-contained
 document unchanged in meaning. No bundler, schema rewriting prototype, or
 live provider compatibility experiment is needed.
 ### Assessment Record
 **Status:** Assessed; use explicit root registration and a no-external-resource
 loader, with coverage for unused schema definitions.
 **Evidence:** `internal/validate/standard_validator.go` has four compilation
 paths; its root loaders already preserve JSON numbers, validate the 2020-12
 dialect, and check source containment/context. `Runner.prepareValidation` uses
 only `ValidationPreparer`, despite storing `Validator`. In pinned jsonschema
 6.0.2, `Compiler.AddResource` registers the decoded document, `roots.go` collects
 embedded IDs/anchors, and `loader.go` consults registered resources and bundled
 metaschemas before the custom loader.
 An offline dependency-contract probe in
 `/tmp/promptkit-assessment-aqn3B8/schema.go`, run with Go 1.27.3 using
 `go run -mod=readonly` and `GOPROXY=off`, registered one document and installed a
 loader that only counts/rejects external loads. Fragment, anchor, recursion,
 absolute self-ID, embedded child-ID, and standard metaschema cases compiled
 with zero external loads; a real external reference failed with one load.
 Crucially, an unused `$defs` entry with an external reference did not trigger a
 load until compiled explicitly. An example payload containing a literal `$ref`
 did not trigger loading. Repeating with a retrieval URI different from the
 document's explicit ID gave the same results. A denying loader alone does not establish
 that every declared schema is self-contained.
 **Recommendation and alternatives:** Retain source-specific root loading, then
 share `compileSchemaDocument(ctx, resourceURL, document)` returning the compiled
 executor. Register the root, retain Draft2020, and install a context-aware loader
 returning an actionable external-resource error without filesystem/network I/O.
 Keep compiler resolution authoritative for IDs and anchors. To cover otherwise
 unused declarations, enumerate schema locations using a small, explicit table
 of the pinned 2020-12 schema-bearing keyword positions (including its supported
 legacy positions) and compile those locations with the same compiler/cache.
 Do not traverse annotation/example objects as schemas. This bounded policy walk
 is not a URI resolver, bundler, or general schema framework. A lexical ban on
 non-fragment references rejects embedded IDs; root-only compilation misses the
 demonstrated unused-definition case. Neither is recommended.
 **Plan handoff:** Specify escaped JSON-pointer location enumeration and retained
 embedded-ID/dynamic-reference semantics in focused cases; preserve dialect and
 number handling. Both direct schema callbacks call the shared compilation only
 after instance decoding, while prepared paths call it eagerly as before. Remove
 external loaders, not root path containment/read helpers. Change runner fields
 and constructor parameters to `validate.ValidationPreparer`, retaining the nil
 no-op and nil-plan error behavior. Validator constructors can return their
 concrete pointer types so existing direct `Validate` callers and preparation
 both compile; update the internal engine Options validator slot to the
 preparation interface too. No public facade signature changes are needed.
 Replace external resource success fixtures with early-error cases, retain independent root-source
 tests, and add public `WithSchemaFile` option/replacement/error coverage.
 ## 4. Specify Ownership And Retention Remedies
 **Catalog:** 4, 16, 18.
 Trace public artifact adaptation and prepared-handle creation, claim, discard,
 details, and namespace-view operations. Inspect which references keep an engine
 alive and which synchronization owns state changes. Trace session normalization
 to its retained copies. Use reference/lifetime analysis first; use an existing
 allocation profile only if the retained graph is unclear.
 Recommend the artifact contract/documentation changes under accepted ownership
 transfer, retaining the defensive copy initially. Specify the prepared-handle
 ownership identity and state transitions without relying on distinct zero-sized
 allocations comparing unequal. Identify the session-string detachment point.
 List relevant concurrent and mutation regressions for implementation, without
 building a new ownership framework or changing lifetimes during assessment.
 ### Assessment Record
 **Status:** Assessed; narrow references rather than adding lifecycle machinery.
 **Evidence:** `artifact_reader.go:publicArtifactReaderAdapter.Read` copies the
 returned body only after the consumer call returns. `PreparedExecution` in
 `internal/usecase/prepared_execution.go` retains `owner *Runner` even after its
 mutex-protected claim/discard drops the payload; `Details` uses separately
 captured data. `Runner` owns repositories, clients, and admission. Namespace
 views delegate to the same internal engine/runner. `NormalizeSessionID` in
 `internal/domain/session.go` returns `strings.TrimSpace(raw)` directly.
 **Recommendation and alternatives:** Document successful artifact return as
 ownership transfer, as accepted, and keep adapter copying. Replace the prepared
 handle's runner pointer with a pointer to a non-zero-sized private identity
 object allocated once by each runner constructor and copied into its handles.
 Keep that immutable token after claim/discard; it retains no runner graph and
 preserves foreign-owner validation order without a new owner-field race.
 Clearing a mutable runner pointer is viable but complicates synchronized checks
 and error ordering unnecessarily. Clone the validated nonempty normalized
 session string with `strings.Clone` before returning it; this detaches padded
 input without imposing a new limit.
 **Plan handoff:** Retain ready-to-claimed/discarded transitions under the current
 mutex, private payload clearing, one-shot execution, and detached details.
 Protect cross-engine rejection, same-engine namespace views, concurrent
 claim/discard, and details after discard/use. Artifact regressions must use
 independently returned buffers and avoid claiming safety for contract-violating
 readers. Existing mutation, trimming, Unicode, hash, and wire assertions remain
 the semantic oracle; a GC timing assertion is unnecessary.
 ## 5. Specify Error Ownership And Preparation-Stage Information
 **Catalog:** 7, 8, 9; informs 25.
 Trace representative collaborator failures through internal wrapping and public
 translation, including direct lookup failures and nested public sentinels.
 Inspect body-reader errors at initial decoding and end verification, current
 redaction, context precedence, and retry classification. Trace diagnostic
 preparation versus dispatch, including legitimate completed no-dispatch cases.
 Recommend how owning-operation information and preparation-stage failures are
 represented and propagated. Specify the distinction between stream I/O failure,
 malformed/truncated content, size overflow, and cancellation using existing
 boundaries where possible. Give a small expected-outcome matrix of public
 category, retained cause, diagnostic completion, and dispatch behavior. Retained
 causes may match multiple sentinels; category exclusivity is not the target.
 ### Assessment Record
 **Status:** Assessed; carry ownership and preparation provenance explicitly.
 **Evidence:** `errors.go:publicErrorFor` uses whole-chain `errors.Is` in a fixed
 order; `mapPublicError` also searches nested capacity/exhaustion/provider types
 before normal mapping. `wrapGenerationError` and artifact loading add operation
 sentinels but no separately readable owning category. In
 `internal/llm/openai_compatible_client.go:decodeOpenAIChatResponse`, both decoder
 calls replace non-context errors with malformed-response messages. In
 `generation.Coordinator.generate`, `PrepareGeneration` fails before any capacity
 attempt, while `SmokeTester.runInference` concludes every generation error as
 report data. `GenerationEvidence` currently lacks preparation-stage information.
 **Recommendation and alternatives:** Add a small internal use-case operation
 error carrying category and cause, with `Unwrap`/`Is` behavior. Apply it at owning
 boundaries and let facade mapping select that category independently of nested
 causes. Preserve legitimate direct not-found mappings when assigning the
 category. Keep specialized public capacity/provider/exhaustion projections, but
 do not let their presence inside a collaborator cause erase the outer owning
 category. A globally reordered sentinel switch cannot express this distinction.
 Add `PreparationFailed bool` to internal `GenerationEvidence`, set only at the
 built-in `PrepareGeneration` failure return. Diagnostic orchestration checks it
 after caller cancellation and returns `ErrInvalidRequest` with the cause.
 Do not infer this stage from error identity or attempt count; injected failures
 and intentional missing-key/capacity reports keep their established semantics.
 This needs no new public field or retry policy.
 Wrap the successful-response reader with a small read-error recorder beneath
 the existing limited reader. At decoding/EOF verification failure, prefer an
 observed context error; preserve size overflow as malformed; otherwise propagate
 an actual non-EOF reader failure through `requestFailedError`. Parser-generated
 syntax/type/truncation failures, EOF-truncated JSON, and actual extra values
 remain malformed. Distinguish errors returned by the reader from those created
 by `encoding/json`, rather than categorizing every `io.ErrUnexpectedEOF` alike.
 Retain redacted default formatting and exact underlying read causes.
 **Plan handoff:** Protect these expected outcomes at the public boundary:
 | Case | Owning category / result | Retained evidence |
 | --- | --- | --- |
 | Client returns child missing-prompt error | `ErrLLMGenerate`; error | Child cause remains matchable, including its category. |
 | Reader returns the same child error | `ErrArtifactLoad`; error | Child cause remains matchable. |
 | Direct missing prompt/profile | Existing not-found category; error | No conversion into a generic load failure. |
 | 2xx body read fails during decode or final EOF check | Generation plus transport; diagnostic transport failure | Original reader cause, no raw body/detail formatting. |
 | Invalid/truncated JSON, extra value, size overflow | Existing malformed-response behavior | No new retry or parser-detail disclosure. |
 | Built-in diagnostic preparation fails | `ErrInvalidRequest`; not a completed diagnostic | Zero dispatch and original preparation cause. |
 | Missing required credential/capacity report | Existing completed diagnostic outcome | No inferred construction failure. |
 | Caller cancellation | Existing cancellation/error handling | Cancellation takes precedence over publishing success. |
 ## 6. Specify Authentication Overflow Reporting And Adapter Ownership
 **Catalog:** 2, 26, 27; uses topic 5's error/stage conclusions.
 Inspect public/domain diagnostic DTOs, outcome labels, body ownership, HTTP
 evidence, authentication recognition, and facade projection. Determine whether
 the selected overflow outcome fits existing fields or needs an explicit
 additive representation. Inventory actual smoke-copy consumers rather than
 assuming full reports need cloning.
 Recommend concrete field/type or outcome changes and their public/internal
 mapping. State the facts reported for overflow: acceptance unknown, explicit
 limit evidence, and independently available HTTP status/timing. Explain the
 interaction with non-success statuses and cancellation without discarding
 established independently known evidence. Preserve neutral reporting and privacy.
 Specify the bounded read/overflow detection operation around the accepted 1 MiB
 allowance, including exact-boundary, missing/inaccurate length, and close behavior.
 Recommend the outbound protocol-adapter seam and narrow target-copy operation.
 Keep the body-bound fix independently implementable before adapter relocation;
 do not add a public budget option or general diagnostic plugin framework.
 ### Assessment Record
 **Status:** Assessed; one reason constant suffices, without a new report field.
 **Evidence:** Public/domain smoke reports already have `Reason`, `Failure`,
 nullable `CredentialsAccepted`, HTTP status on attempts, and timing. Current
 `smoke_authentication.go` reads a body only to recognize HTTP 200; 401 establishes
 rejection without reading it. Other statuses retain their existing outcome.
 `smoke_tester.go` copies these facts into attempts and `finishHTTP` handles
 caller cancellation. The outbound client already owns authenticated GET and
 HTTP evidence. The broad domain request/report cloners are used only by their
 self-tests and a target-only copy respectively, as recorded in audit 11.
 **Recommendation and alternatives:** Add matching public/domain
 `SmokeTestReasonAuthenticationResponseLimitExceeded` constants with value
 `authentication_response_limit_exceeded`. On a 200 recognition overflow set that
 reason, existing `ExecutionFailureOther`, acceptance nil, and retain HTTP/timing
 facts; conclude with a nil Go error unless caller cancellation applies. A new
 general failure enum or report Boolean is unnecessary: the existing reason
 already provides an explicit machine-readable diagnostic. Keep 401 rejection
 and non-200 behavior independent of unused response bodies.
 Read at most allowance plus one byte with `io.LimitReader`/`io.ReadAll`, detect
 length greater than 1 MiB before JSON recognition, and close without draining.
 Do not trust `ContentLength`. Existing bounded bytes plus one-byte lookahead are
 sufficient; streaming the small account parser adds complexity without need.
 Cancellation takes its existing precedence; overflow is not malformed content.
 Move account-response recognition and bounded response ownership into an
 `internal/llm` OpenRouter authentication operation, returning HTTP evidence,
 optional acceptance, overflow/unrecognized indicators, and operational error.
 Move default endpoint derivation into a small llm adapter helper used by
 selection; explicit overrides remain unchanged. Use-case orchestration maps
 those factual results to report reasons/completion and consumes a narrow
 authentication capability alongside reachability HTTP capability. No reverse
 dependency or plugin registry is needed. Replace target-only full-report cloning
 with direct target/provider-map detachment; retain facade projection and active
 backend cloners.
 **Plan handoff:** Fix and test the byte bound before relocation. Include exact
 limit versus limit-plus-one, escaping/invalid bodies, inaccurate declared length,
 closure, 401 without body consumption, context interruption, redaction, and
 detached report values. Update reason GoDoc/public conversion and focused
 diagnostic documentation in the same implementation unit. No secret-bearing
 body, header, or provider detail is added to report data.
 ## 7. Assess JSON Copying Compatibility And Provider Overlay Cost
 **Catalog:** 19, 24; uses topic 2's converter-removal boundary.
 Inventory callers of facade copying, runtime JSON validation/copying, prepared
 snapshots, and configuration overlay. Build a compact compatibility matrix for
 accepted concrete types, nil/indirection handling, exact numbers, empty keys,
 error behavior, bounds, and mutable ownership. Separate trusted-value copying
 from fallible input acceptance and source encoding.
 Collect existing overlay benchmark/allocation evidence, supplemented only where
 needed with representative depth, breadth, overlapping/disjoint maps, and array
 replacement cases within current limits. Identify repeated visits/copies and
 their construction-time cost; respect the existing bounded-depth qualification.
 Recommend which traversal can actually be removed, the shared operation's
 contract, and the overlay algorithm/ownership model. Prefer retaining a small
 distinct walker over a configurable framework when policies differ. Recommend
 implementing or explicitly deferring the optional overlay optimization based on
 expected benefit and complexity; identify estimates as such. Do not add errors,
 panics, or silent fallbacks to an infallible facade projection.
 ### Assessment Record
 **Status:** Assessed; implement the overlay optimization and centralize trusted
 copy ownership, retaining distinct acceptance policies.
 **Evidence:** `targets.go:overlayProviderMap` clones the complete lower subtree
 at every recursive overlap, then clones replacement values. `convert.go:copyAny`
 has fast paths plus `copyReflectValue`; graph callers are prepared details,
 client requests, execution targets, and structured schemas. These values have
 already crossed an acceptance/copy boundary. `internal/jsonvalue` instead owns
 fallible input acceptance and bounded copying. The concrete differences are:
 | Property | Runtime `Copy` / `CopyMap` | Existing facade projection |
 | --- | --- | --- |
 | Numbers and typed collections | Validates; preserves compatible concrete types and exact `json.Number`. | Copies accepted values without numeric interpretation. |
 | Indirection / null | Dereferences and normalizes null, sometimes changing container type. | Reflection preserves pointers/typed nils; fast paths have their existing nil behavior. |
 | Keys and errors | General schema keys allowed; provider keys cannot be empty; fallible limits/cycle checks. | Infallible; trusts earlier acceptance; no new checks. |
 | Mutation | Returns independent accepted state. | Returns independent client/inspection state. |
 **Measurements:** An external Go test overlay calls the unchanged private
 overlay function with nested chains containing two scalar keys per level and
 an array leaf; inputs are built outside timing. Go 1.27.3, linux/amd64,
 Intel i5-7260U, `-cpu=1 -benchmem -benchtime=50x -count=3`:
 | Depth / width / overlap | Observed ns/op range | B/op | Allocs/op |
 | --- | --- | --- | --- |
 | 2 / 2 / overlapping | 20,104–34,618 | 9,496 | 236 |
 | 12 / 2 / overlapping | 263,387–287,814 | 117,869 | 2,609 |
 | 40 / 2 / overlapping | 2,355,659–2,580,220 | about 1,241,620 | about 22,672 |
 | 4 / 16 / overlapping | 168,483–178,889 | 65,434 | 1,591 |
 | 12 / 2 / disjoint upper root | 49,437–53,966 | 32,496 | 686 |
 Harness: `/tmp/promptkit-assessment-aqn3B8/config_test.go`, mapped only in the
 Go invocation by `overlay.json`; command was `go test -mod=readonly -overlay=…
 ./internal/configuration -run '^$' -bench '^BenchmarkAssessmentOverlay$'` with
 the flags above, `GOTOOLCHAIN=local GOWORK=off GOPROXY=off`. Repository sources
 were not edited. These are baseline costs, not measured optimized speedups.
 **Recommendation and alternatives:** Clone lower once, then recurse into that
 owned result for overlapping built-in maps, copying only upper replacements.
 This removes repeated descendant clones without another index or framework;
 the measured allocations justify this small construction-time improvement.
 Preserve null/array replacement, accepted types, error boundaries, and isolation.
 Put infallible trusted cloning in `internal/jsonvalue.CloneTrusted(any) any` and
 route facade nested values through it. Preserve current fast-path/null/type
 behavior explicitly. Do not substitute fallible `Copy` and hide its error.
 Keep validation traversal separate where normalization differs; share only
 structural helpers that actually match. Moving trusted cloning to its existing
 owner removes the facade's independent implementation responsibility, but does
 not by itself eliminate both traversal algorithms. Forcing one configurable
 reflection walker is not justified by this evidence.
 **Plan handoff:** Remove source conversion first; preserve independently
 specified mutation/type/nil/schema-key cases. Measure the changed overlay with
 these same shapes after implementation; do not promise the timing ranges or
 global linear-time validation. No optional optimization is deferred here.
 ## 8. Assess Requirement Evidence Accumulation And Traversal
 **Catalog:** 10, 23.
 Trace ownership and merging of condition-evidence sets and the shared versus
 node-specific responsibilities of `if`/`with`. Inspect real-renderer comparison
 tests and scope/reachability cases. Collect operation counts or targeted
 baseline measurements across increasing left-heavy recognized conditions;
 include a small ordinary case so pathological scaling is not the only input.
 Recommend an accumulation/merge algorithm and a narrow branch-orchestration
 boundary, explaining expected work without promising a new universal complexity
 contract. Keep the algorithmic fix distinct from traversal cleanup. Specify
 preserved dot/root scopes, inactive computed names, and conservative incomplete
 analysis. No interpreter, expanded grammar, or expression limit is proposed.
 ### Assessment Record
 **Status:** Assessed; use owned-set merging and one explicit branch protocol.
 **Evidence:** `requirements.go:evaluateValue` creates fresh missing-name sets;
 `eq`/`ne` combine recursive evaluation results using
 `mergeConditionEvaluations`, which copies every member into fresh sets on each
 merge. Later evaluation reads operand values/known flags, not independent
 snapshots of these sets. For a left-heavy tree with n distinct missing names,
 the source performs `2 + 3 + … + n` membership insertions in merges, excluding
 leaf creation: 9 at n=4, 135 at n=16, and 8,255 at n=128. This is an exact
 source-derived work count for the described case, not measured elapsed time.
 The ordinary two-name case needs only two such insertions.
 `requirementWalker.visit` repeats branch selection, dependency-delta tracking,
 inactive traversal, and limitation recording for IfNode/WithNode. The latter
 changes body dot but keeps else dot. Existing known-condition/scope tests compare
 against actual Go rendering and remain independent semantic evidence.
 **Recommendation and alternatives:** Treat intermediate evidence sets as owned
 by their evaluation result. Merge into the larger existing set, adding only
 the smaller set's members (nil sets transfer directly), while combining flags
 as now. This removes the repeated copying in the demonstrated left-heavy case
 and bounds repeated movement better on balanced trees. A single global mutable
 accumulator would complicate branch-local evidence and is not needed.
 Share IfNode/WithNode orchestration through their existing `parse.BranchNode`
 representation, handling the With node's body-dot calculation explicitly inside
 the narrow helper. Keep recognition/evaluation separately readable; do not
 merge the inspector with template execution. A generic visitor/callback
 framework or more recognized syntax would not help this defect.
 **Plan handoff:** Protect set union/flag outcomes and representative left-heavy
 inspection without asserting helper allocation counts as a durable contract.
 Retain known/skipped/unknown branch classification, changed-dot/root access,
 inactive computed-name behavior, and meaningful limitation bookkeeping. The
 algorithmic fix may land before branch extraction; both remain selected work.
 ## 9. Assess Bounded Repair-Feedback Encoding
 **Catalog:** 17.
 Inspect feedback framing, JSON escaping, truncation, and the locations retaining
 full diagnostics and prior output. Measure current formatting with ordinary,
 large, and heavily escaped synthetic diagnostic strings, separating final output
 size from temporary allocations. Identify which complete serializations account
 for the avoidable memory cost.
 Compare a bounded incremental approach with the current implementation using
 source-level algorithm and complexity reasoning; no alternative encoder needs
 to be built. Recommend an encoding/truncation approach and its preservation
 cases, or a justified proposed deferral if benefit does not warrant complexity.
 Any deferral must acknowledge the outstanding allocation issue. Do not cap raw
 diagnostics, discard stored errors, or assert an exact peak-heap guarantee.
 ### Assessment Record
 **Status:** Assessed; implement bounded normalization/encoding, not a deferral.
 **Evidence:** `repairer.go:formatRepairDiagnostics` normalizes every complete
 diagnostic, marshals the whole list, then marshals complete entries again when
 over budget. Truncation also marshals candidate prefixes repeatedly. Full errors
 and previous candidate are retained separately from this feedback string.
 An external test overlay calls only the unchanged formatter. With Go 1.27.3,
 the topic 7 CPU/environment, `-cpu=1 -benchmem -benchtime=20x -count=3`, one
 64-byte ASCII diagnostic costs about 780–1,198 ns and 224 B/op. A 1 MiB ASCII
 diagnostic costs 5.83–7.99 ms and about 6.81 MB/op; a 1 MiB string repeating
 `<&>` plus NUL costs 27.7–39.1 ms and 44.12 MB/op. Observed output lengths are
 68, 65,536, and 65,531 bytes respectively. These are baseline aggregate
 allocations, not live-heap peaks or measured savings from a replacement.
 Harness: `/tmp/promptkit-assessment-aqn3B8/usecase_test.go` via
 `feedback-overlay.json`; `go test -mod=readonly -overlay=… ./internal/usecase
 -run '^$' -bench '^BenchmarkAssessmentFeedback$'` with the flags above. Input
 strings are built outside timing; input/output lengths are recorded after
 timing to avoid Go's ResetTimer clearing custom metrics. A preliminary run
 without these metrics found similar allocation magnitudes; the final timings
 above are noisy and are not claimed as stable throughput.
 **Recommendation and alternatives:** Preserve the complete-list fast result
 when it fits by first attempting bounded construction. If it cannot fit, build
 the bounded omission form with the existing reservation/order rules. Process
 only each candidate's potentially useful normalized prefix, retaining the
 current `strings.ToValidUTF8` behavior for runs of invalid bytes and rune-safe
 truncation. Use standard `json.Marshal` on bounded normalized strings and the
 existing bounded-prefix selection logic rather than implementing a general
 JSON escaper. Escaping may expand bounded scratch space, but must not cause
 serialization proportional to an unbounded original diagnostic. A pure
 `json.Encoder` into a limited writer is insufficient if it constructs the whole
 encoded string before writing. The measured large-string allocation justifies
 the focused change; retaining current allocation is not recommended.
 **Plan handoff:** Keep the 64 KiB output rule, ordering, omission marker, valid
 JSON, HTML/control escaping, Unicode/invalid-byte normalization, and full stored
 errors/candidate. Include fit, exact boundary, oversized single entry, many
 entries, and heavily escaped/invalid strings. Measure the same baseline shapes
 after implementation; do not make peak-memory or timing values a public promise.
 ## 10. Assess Namespace Listing Index Tradeoffs
 **Catalog:** 20.
 Inspect inventory capture, namespace identity, ordering, filtered retrieval,
 cancellation, and result detachment. Gather baseline time/allocation evidence for
 unfiltered listings and sparse, dense, and absent namespace matches at ordinary
 and larger valid inventory sizes. Consider both a single request and repeated
 namespace inspection, without assuming every consumer repeatedly lists entries.
 Compare captured buckets/ranges with the existing scan. Account for construction
 work, retained index memory, and query output copying; do not optimize query time
 while ignoring its construction/retention tradeoff. Recommend a specific layout
 and query algorithm, or a justified proposed deferral. No pagination, runtime
 cache, or new ordering/cancellation guarantee is needed.
 ### Assessment Record
 **Status:** Assessed; use ranges in existing sorted inventories, not a new
 persistent namespace index.
 **Evidence:** Configuration captures lexically sorted ID slices in `load.go`.
 Its `listing.go` copies the whole slice before engine `filterIdentityList`
 scans and appends matches, even for All mode. Qualified IDs for an exact
 `namespace + "/"` prefix form a contiguous sorted range; unqualified IDs need
 not form one range. The current private inventory interface has no filter input.
 An external overlay benchmark of the unchanged engine filter uses a list
 callback matching configuration's whole-slice copy. Synthetic sorted valid IDs
 are built outside timing: sparse selects one ID, dense selects half, absent
 selects none. Go 1.27.3, same CPU/environment as topic 7,
 `-cpu=1 -benchmem -benchtime=100x -count=3`:
 | Total IDs | Mode | ns/op range | B/op | Allocs/op |
 | --- | --- | --- | --- | --- |
 | 32 | All / sparse / dense / absent | 1,176–1,332 / 759–937 / 1,053–1,875 / 797–819 | 1,472 / 528 / 960 / 512 | 5 / 2 / 4 / 1 |
 | 1,024 | All / sparse / dense / absent | 41,851–48,965 / 13,860–19,334 / 38,416–45,031 / 15,258–19,282 | 78,144 / 18,448 / 37,184 / 18,432 | 11 / 2 / 9 / 1 |
 | 4,096 | All / sparse / dense / absent | 194,479–202,439 / 92,265–95,215 / 148,209–151,180 / 93,157–94,526 | 305,472 / 65,552 / 166,208 / 65,536 | 14 / 2 / 12 / 1 |
 Harness: `/tmp/promptkit-assessment-aqn3B8/listing_test.go` via
 `listing-overlay.json`; `go test -mod=readonly -overlay=… ./internal/engine
 -run '^$' -bench '^BenchmarkAssessmentListing$'` with the flags above. This
 isolates filtering/copy cost, not full engine construction or public projection.
 Repeated namespace requests repeat that measured whole-inventory allocation.
 **Recommendation and alternatives:** Resolve the filter in the engine first.
 Pass an internal `configuration.IdentityFilter{All bool, Namespace string}` to
 the captured inventory: All copies the complete slice once; named selection
 uses binary search to find the prefix's start/end and copies only that range;
 empty Namespace with All false scans for unqualified entries directly from
 immutable state, without first copying everything. Apply the same selection
 to backend/profile IDs and prompt identities, preserving ordering and final
 context checks. No public signature changes are needed.
 This selects the audit's sorted-range alternative: named selection has expected
 comparison work proportional to log N plus its output, while unqualified
 selection remains a scan. Retaining buckets/range maps could reduce repeated
 named lookup to a map operation and index unqualified results, but adds per-kind
 retained state and construction work even when a consumer never lists resources.
 Existing sorting already supplies named ranges with no new persistent index or
 additional construction traversal. The measured wasted copying justifies the
 simple range remedy, not extra permanent buckets. These cost comparisons are
 design estimates; no alternative implementation was benchmarked.
 **Plan handoff:** Update the private inventory interface and its test fakes;
 test exact namespace prefixes, prefix-sharing names, mixed unqualified entries,
 All/default/view scope, absent results, mutation isolation, and cancellation.
 Repeat the baseline measurements after implementation. Do not introduce a
 cache, pagination, or a new unqualified-query complexity guarantee. This is a
 selected remedy, not a proposed deferral of catalog 20.
 ## 11. Select Remaining Refactoring, Test, And Cleanup Boundaries
 **Catalog:** 11–14, 22, 25, 28–34; consolidate related conclusions above.
 Reuse existing audit evidence and perform targeted caller checks rather than
 reauditing these findings. Identify the configuration helper boundaries,
 generation attempt-result fields, and accounting seam consistent with topics
 2–8. Locate the real coordinator assembly to use in scheduling tests and the
 behavioral coverage that must survive wrapper retirement.
 Select one independent bundled-catalog test oracle and the smaller distinct
 risks owned elsewhere. Identify privacy-formatting cases, public schema-file
 coverage from topic 3, and replacement assertions for opaque hashes. Map obsolete
 fields/helpers to actual callers and tests, including serialized definition-hash
 effects. Record the owning documentation for each correction/migration.
 Recommend a concrete removal/extraction inventory, preservation tests, and
 ordering dependencies. Do not infer that self-tests justify production helpers,
 or that lack of example coverage makes supported APIs obsolete. This is not a
 new deletion sweep, exact helper-design exercise, or complexity-metric target.
 ### Assessment Record
 **Status:** Assessed; retain focused package boundaries and remove the recorded
 residue, not a broader subsystem.
 **Evidence:** Current `validateEffective`, `materializePrompt`, and
 `buildExecutionProfiles` match the responsibility mixtures in audit 03. Current
 `Coordinator.execute` returns outcome, dispatched, two durations, and start time;
 the retry loop independently projects these into evidence and observation.
 Graph caller checks reconfirm eight test callers for `capacity.NewClient`, only
 the respective self-test for `RelativePath`/`resourceNamespaceFromID`, and no
 callers for `stringPtr`. `loaded.backends` is only populated during resolution;
 `QueueCapacitySet` is only assigned/asserted. Domain `OutputFormat` duplicates
 the validated output contract; runtime `ContentFile` is not populated by prompt
 capture. `HashDefinition` marshals these fields, so their deletion changes hashes.
 Private reachability `initialEndpoint` and the third `fileSource` result have
 the unused roles recorded in audit 12.
 `internal/configuration/bundled_test.go` already has the complete independent
 17-profile/model inventory, but uses formatted-map plugin checks. Public bundle,
 wire, and smoke tests repeat expected models/defaults. `formatting.go` implements
 RunRequest formatting; `types.go` omits its direct API key from JSON. Existing
 artifact size-hint tests calculate SHA-256 despite opaque public hash semantics.
 **Recommendation and alternatives:** Use these concrete extraction/removal units:
 - Keep `validateEffective`'s final-resource/index traversal; extract backend,
  profile, and prompt record validators with explicit record/path/index inputs.
  Keep typed presence interpretation together in execution-profile construction.
 - Split prompt materialization into input/metadata projection, message
  content/template capture, and output-contract conversion. Retain lazy origin
  lookup, source-relative reads, and a single final inspection/hash assembly.
  Do not add a second configuration validation pass or generic field schema.
 - Replace execute's parallel returns with an `attemptResult` carrying
  `Outcome llm.AttemptOutcome`, `Dispatched`, `CapacityWait`, `RequestDuration`,
  and `StartedAt`. Share usage/evidence/event projection helpers where the facts
  match. Keep built-in retry and injected one-shot control flow separate; release
  permits before accounting callbacks/backoff. Topic 5's stage marker remains
  independent of attempt accounting.
 - Change the initial/repair scheduling test to `generation.NewInjected` with
  the same capacity manager, then retire production `capacity/client.go` and
  its retention prose. Test capacity primitives directly or with a small
  test-only wrapper; preserve FIFO/cancel/race/panic/independent-pool scenarios.
 - Keep the complete bundled asset oracle in `internal/configuration/bundled_test.go`
  and use structural plugin expectations there. Public option tests own toggles,
  order, isolation, and override behavior. Keep a small wire test of a controlled
  model/plugin override and a smoke test of configured default selection; do not
  repeat the complete maintained model matrix outside its owner.
 - Add marker-based formatting tests for RunRequest values/pointers with `%v`,
  `%+v`, `%#v`, and direct String/GoString, plus direct-key JSON omission.
  Put markers in omitted contents, such as variables, bodies, and execution
  settings, not IDs deliberately present in summaries. Do not pin the entire
  formatted or serialized shape.
 - Replace size-hint literal digests with same-body inline/file hash equality;
  retain body/actual-size/read-boundary assertions. Prepare an opaque benchmark
  expected hash outside timing instead of independently selecting its algorithm.
 - Delete only unused backend presence capture/field list/map and the runtime
  queue-presence flag; keep profile/input presence and ConfigKit provenance.
  Remove duplicate captured output format/runtime message-file fields and their
  unreachable fallback, preserving actual YAML loading and override defaults.
  Remove the private probe endpoint echo, discarded helper return, orphan
  wrappers/self-tests, and unused pointer helper identified above.
 Keeping existing broad functions is viable but leaves the audited review burden;
 a general configuration/attempt framework would obscure the explicit rules.
 No evidence justifies either alternative over these small extractions.
 **Plan handoff:** Correct credential, provider-map, and identity comments in their
 canonical owners. Update internal assembly/capacity/validation descriptions when
 code lands, and consumer/format/wire guidance plus release migration notes for
 ownership, schema, accepted source values, and definition hashes. Include topic
 3's public schema-file wiring cases. Preserve request override empty-format
 defaulting and inspection/preparation hash equality, not literal old hashes.
 Independent caller/behavior checks, not graph reachability alone, justify deletion.
 ## 12. Consolidate Recommendations For Implementation Planning
 Review the assessment records in order and reconcile cross-topic choices.
 Produce a compact handoff covering all 34 catalog entries: selected remedy or
 explicit proposed deferral, supporting assessment topic, consequential design
 choice, dependencies, and implementation-time validation. Findings whose remedy
 was already settled need only a brief mapping, not another investigation.
 Ensure source conversion disappears rather than migrating into shared copying;
 schema simplification and compilation agree; errors/stages precede accounting
 refactoring; the authentication fix can precede relocation; and actual
 coordinator tests precede wrapper removal. Separate optional cleanup from fixes
 so a deferral does not obstruct unrelated remediation.
 Record any scope/contract question that still needs maintainer direction with a
 recommendation and viable alternative. A deferral is a recommendation, not
 silent authorization to drop accepted work. Unavailable measurements or tooling
 must be identified, together with whether they could change the recommendation;
 do not present a conditional choice as a settled implementation instruction.
 Once consequential choices are settled, the subsequent implementation plan can
 define focused ordered stages, selected designs, migration/documentation work,
 and proportionate validation. Implementation correctness, race regressions,
 post-change measurements, and release checks remain work for implementation and
 release preparation. No claim of remediation completion follows from this
 assessment, and no new recurring release or human-review gate is introduced.
 ### Assessment Record
 **Status:** Assessed; all twelve topics have recommendations. No remediation is
 implemented, and no catalog entry is proposed for deferral.
 **Evidence and recommendation:** The source review, dependency probe, baseline
 measurements, and caller checks recorded above settle the consequential choices.
 Keep the roadmap's accepted product scope. Use the following mapping as the
 handoff inventory, not as 34 mandatory implementation stages:
 | Catalog | Assessment topic | Recommended remedy | Implementation evidence to retain/add |
 | --- | --- | --- | --- |
 | 1 | 1 | Select existing Go 1.27.3; document ordinary-development selection. | Actual toolchain version and focused advisory reassessment; no consumer-minimum bump. |
 | 2 | 6 | Bounded authentication read and explicit limit reason. | Exact/overflow and inaccurate-length cases, closure, neutral acceptance facts. |
 | 3 | 2 | Remove pre-Mapping recursive source expansion. | Direct nested handoff/capture and ConfigKit-deferred cycle diagnostics. |
 | 4 | 4 | Artifact result ownership transfer; keep defensive adapter copy. | Public GoDoc, independently owned concurrent returns, adapter isolation. |
 | 5 | 2 | Remove lossy number conversion with the same adapter. | Unsupported-number deferred error and supported built-in numeric handoff, not new precision promises. |
 | 6 | 3 | Self-contained root plus compiler-enforced reference policy. | Internal/embedded IDs and anchors work; external references, including unused definitions, fail before dispatch. |
 | 7 | 5 | Explicit owning-operation category across public mapping. | Nested client/reader causes and specialized public error preservation. |
 | 8 | 5 | Record actual response-reader failures separately. | Both decoder stages, retained cause/redaction, malformed versus transport distinction. |
 | 9 | 5 | Internal built-in preparation-failure evidence flag. | Invalid diagnostic construction returns an ordinary Go error; intentional reports remain reports. |
 | 10 | 8 | Merge owned temporary sets small-to-large. | Representative deep condition outcomes and preserved independent renderer comparisons. |
 | 11 | 11 | Test request formatting privacy at its public boundary. | Synthetic-marker assertions for value/pointer formats and direct-key JSON omission. |
 | 12 | 11 | Correct credential-inspection GoDoc/example. | Explicit profile environment selection versus backend-derived default. |
 | 13 | 11 | Correct provider-map integration summary. | Link to format-owned recursive overlay versus runtime replacement semantics. |
 | 14 | 11 | Correct identity/listing comments. | Literal IDs and current collection release-version ownership. |
 | 15 | 3 | Public single-schema-file wiring tests. | Real temporary schema, source replacement/precedence, relevant path errors. |
 | 16 | 4 | Standalone immutable runner ownership token. | Foreign owner, namespace view, one-shot claim/discard, retained details. |
 | 17 | 9 | Bounded normalized-prefix construction and JSON encoding. | Existing output semantics and same-shape post-change allocation measurements. |
 | 18 | 4 | Clone accepted normalized session strings. | Existing Unicode/trim/content/hash/wire behavior. |
 | 19 | 7 | Clone lower once; overlay into owned descendants. | Null/array/map semantics, input isolation, repeat baseline measurements. |
 | 20 | 10 | Select sorted named ranges before copying. | Sparse/absent/mixed/All/view cases, detachment/cancellation, repeat measurements. |
 | 21 | 3 | Shared compilation and explicit preparation interface. | Source-specific containment, direct malformed-output ordering, frozen validation. |
 | 22 | 11 | Record-specific configuration and capture helpers. | Final-handoff/presence/origin behavior and meaningful error paths. |
 | 23 | 8 | Share branch orchestration; separate evaluation/evidence responsibilities. | If/With scope, skipped paths, partial coverage, independent rendering oracle. |
 | 24 | 7 | Centralize trusted clone ownership; preserve distinct validation policies. | Concrete types, nils, numbers, schema keys, caller-owned snapshots; no new projection failure. |
 | 25 | 11 | Attempt-result value plus shared accounting projections. | Permit lifetime, status-only retry, injected single dispatch, evidence and usage presence. |
 | 26 | 6 | OpenRouter authentication protocol in outbound adapter. | Default/override destination, anonymous probe, factual reporting/privacy. |
 | 27 | 6 | Direct target detachment; retire unused smoke cloners. | Provider-map errors, facade ownership, live backend metadata copying. |
 | 28 | 11 | One independent bundled catalog oracle. | Smaller option, controlled wire, and diagnostic-selection tests. |
 | 29 | 11 | Opaque relational artifact hash assertions. | Complete body/actual size and source parity; benchmark setup outside timing. |
 | 30 | 11 | Remove unused backend presence bookkeeping. | Explicit zero/default queue behavior and retained operator provenance. |
 | 31 | 11 | Remove duplicate captured fields/fallback. | Real content-file capture, override default, hash equality relationships and migration note. |
 | 32 | 11 | Remove private endpoint echo and unused directory return. | Actual sanitized HTTP evidence and public schema-file behavior. |
 | 33 | 11 | Remove the three orphan helpers and obsolete self-tests. | Caller check plus retained real discovery/identity/listing behavior. |
 | 34 | 11 | Move scheduling test to coordinator; remove production wrapper. | FIFO/cancellation/panic/independent-backend assertions remain with owning components. |
 **Dependencies and plan boundaries:** Establish toolchain selection; remove the
 source converter before trusted-copy work. Deliver schema policy/shared compiler
 and its typed dependency in focused units, with source/wire regressions. Correct
 owning errors, stream failures, and diagnostic preparation provenance before
 accounting extraction. Authentication bounding/reporting can land before adapter
 relocation. Apply the evidence-set fix before branch cleanup where it simplifies
 review. Migrate the scheduling test before deleting the wrapper; adjust opaque
 hash assertions before removing serialized definition fields. Documentation
 corrections and independent cleanup can proceed without waiting on unrelated
 performance work.
 Split these into prompt-sized implementation stages rather than one stage per
 workstream. Keep consequential defects and optional refactoring separately
 reviewable, and update the affected canonical documentation with each behavior
 change. Stage-level tests should protect the risks in the table rather than
 reproduce every helper branch. The final remediation validation can use the
 existing offline workflow without creating additional recurring release gates.
 **Remaining uncertainty and alternatives:** None requires a new product decision
 or external publication before planning. Alternatives and rejected complexity
 are recorded in the owning topic. Benchmarks of unimplemented alternatives,
 post-change peak heap, provider acceptance, and downstream deployments were not
 measured and are not claimed. Baseline results establish the avoidable work;
 implementation must verify actual improvement and preservation. The schema probe
 exposes a concrete unused-definition case that the plan must include, rather
 than silently declaring a rejecting loader sufficient.
 **Scope verification:** Only this documentation file is changed in PromptKit.
 The temporary harnesses are outside the repository, exercise unchanged code or
 the pinned dependency, and make no provider calls. No production implementation,
 repository test, module metadata, installed toolchain, public contract, or
 release has been changed by the assessment.