- Keep producer routing, destination selection, transform policy, publish policy, transfer policy, and backend credentials out of source manifests.
- Keep `pkg/upload` focused on producer-side bundle submission and status polling.
- Keep server-side upload authentication, authorization, queueing, status, and publish orchestration in `internal/app`.
- Keep archive extraction and staged bundle validation in `internal/ingest`.
- Keep durable status, durable idempotency, retry endpoints, cancellation endpoints, and wait helpers out of the current implementation until a new roadmap item defines them.