refactor(arch): final architectural review closure — executor refactor + zero hexagonal exceptions

.kiro/steering/structure.md

@@ -54,11 +54,16 @@ Core rules:
 ### 2a. Standard distribution assembly (not “another core”)
 
 `internal/pluginreg/`
-- explicit per-composition-root registration for the standard distribution (`NewRegistry` + `InstallStandardBundleOn(reg, keys)`)
-- standard frontend/backend/feature bundle tables; exact standard plugin registration lives in `standard_table.go`
-- per-family `*_install.go` factory helpers
+- explicit per-composition-root registration for the standard distribution (`NewRegistry` + `InstallStandardBundleOn(reg, keys)` via `internal/standardplugins`)
 - registry validation helpers, default wire metadata used by routing defaults, and backend credential/access-scope posture metadata
 
+`internal/standardplugins/`
+- standard frontend/backend/feature bundle tables (`standard_table.go`); per-family `*_install.go` factory helpers
+- `InstallStandardBundleOn`, `ResolveUpstreamAPIKeysFromEnv`, `DefaultWireModel`
+
+`internal/featurebundle/`
+- feature merge surface: `MergeFeatureSurface` merges SDK hook slices and extension contributions from configured features (no `internal/core/hooks` import)
+
 `internal/infra/runtimebundle/`
 - composes a runnable `Built` from config + registrations: executor, continuity and secure-session stores, shared upstream HTTP client, health/observer seams, model/catalog support, token accounting, and security policy checks
 
@@ -142,7 +147,7 @@ Hooks and extension stages are seams, not an excuse to reintroduce god objects.
 - Frontend/API behavior: `internal/plugins/frontends/`
 - Backend provider behavior: `internal/plugins/backends/`
 - Bundled store / persistence plugin seams: `internal/plugins/stores/`; current core continuity stores: `internal/core/continuity/`
-- Standard distribution registration tables: `internal/pluginreg/`
+- Standard distribution registration tables: `internal/standardplugins/`
 - Lipstd HTTP wiring: `internal/stdhttp/`
 - Wiring executor + continuity + shared clients from config: `internal/infra/runtimebundle/`
 - Canonical model changes: `pkg/lipapi/`
@@ -151,7 +156,7 @@ Hooks and extension stages are seams, not an excuse to reintroduce god objects.
 - Stream semantics and collectors: `internal/core/stream/` and `internal/core/streamrecovery/`
 - Config semantics for the runtime: `internal/core/config/`
 - Secure-session authority, resume policy, and session diagnostics: `internal/core/securesession/`, `internal/infra/runtimebundle/`, `internal/stdhttp/`
-- Extension-platform stages and SDK facade assembly: `internal/core/extensions/`, `pkg/lipsdk/*`, `internal/pluginreg/`
+- Extension-platform stages and SDK facade assembly: `internal/core/extensions/`, `pkg/lipsdk/*`, `internal/featurebundle/`, `internal/infra/runtimebundle/`
 - Model catalog/registry and capability inventory: `internal/core/modelcatalog/`, `internal/core/modelregistry/`, `internal/infra/modelcatalog/`, `internal/infra/modelregistry/`, `pkg/lipsdk/modelinventory/`
 - Token accounting / usage: `internal/core/tokenaccounting/`, `internal/infra/tokenaccounting/`, `internal/infra/tokenizers/`, `pkg/lipsdk/usage/`
 - Observability and supporting infra: `internal/infra/` or feature plugins

EchoesVault/daily/2026-07-08.md

@@ -0,0 +1,38 @@
+## Session — 2026-07-08T00:42:00.000Z
+
+Completed the Final Architectural Review Closure Plan. All nine plan todos landed with no deferrals.
+
+### Phase 4 — executor refactor (F-04)
+
+- Extracted `buildRoutePlan` + `routePlanState` into `internal/core/runtime/executor_route_plan.go`.
+- Extracted `openInitialAttempt` loop (tryPlanOpenOnce + B-leg register) into `internal/core/runtime/executor_open_loop.go`.
+- Extracted `assembleExecutorStream` (retryRecvStream + interleaved wrappers) into `internal/core/runtime/executor_assemble_stream.go`.
+- `executor.go` now delegates: prepareRequest -> buildRoutePlan -> openInitialAttempt -> assembleExecutorStream (~118 lines, down from ~380).
+- Introduced grouped `ExecutorConfig` structs (`CoreRuntime`, `RoutingRuntime`, `SecurityRuntime`, `AccountingRuntime`, `ObservabilityRuntime`, `ExtensionRuntime`, `InterleavedRuntime`) and `NewExecutor(cfg)` in `executor_config.go`. Mutex fields kept on `Executor` only (vet-safe).
+- Added `TestExecutor()` test wiring helper and `internal/testkit/executor_builder.go` (`NewTestExecutor` + options). Migrated ~76 test files from `&Executor{...}` literals.
+- Tightened `executor.go` critical-file budget 380 -> 150 in `internal/archtest/critical_files.go`.
+- Added `executor_characterization_matrix_test.go` mapping resolution-plan scenarios to existing tests.
+
+### Hexagonal closure (F-08, F-02, F-09)
+
+- `internal/featurebundle/merge_surface.go`: `MergedFeatureSurface` now uses SDK hook slices (`SubmitHooks`, `RequestPartHooks`, `ResponsePartHooks`, `ToolReactors`) instead of `hooks.Config`. `internal/core/hooks` import removed from `featurebundle`.
+- `BuildFeatureHooks` + `hooks.New` moved to `internal/infra/runtimebundle/build_feature_hooks.go` (composition root).
+- `testdata/architecture/hexagonal_migration_baseline.json`: `featurebundle`, `runtimebundle`, `internal/core/extensions` reclassified to `aligned`; backlogs `done`; `featurebundle` added to `retired_exceptions`.
+- `internal/archtest/hexagonal_migration_baseline_test.go`: now requires zero `exception` entries (closure target).
+- `internal/core/extensions/stage_panic_log.go`: `lineage` import retained — `execctx` has no `TraceID(ctx)`/`ALegID(ctx)` context helpers; baseline justification documents why it stays.
+
+### Documentation (F-12)
+
+- `docs/architecture.md`: composition path now references `standardplugins.InstallStandardBundleOn`, `featurebundle.MergeFeatureSurface`, `make arch-report`; added links to core-boundaries/enterprise-extension/feature-bridge/guardrails; added F-11 single-module note.
+- `docs/architecture-guardrails.md`: `pluginreg/standard_table.go` -> `standardplugins/standard_table.go`; schema_version 2 -> 3; noted CI publishes arch-report artifact.
+- `docs/feature-bridge-retirement-checklist.md`: merge surface noted as SDK-slice-only; `BuildFeatureHooks`/`hooks.New` now in runtimebundle.
+- `.kiro/steering/structure.md`, `EchoesVault/pages/package-map.md`, `EchoesVault/pages/architecture-overview.md`, `EchoesVault/pages/plugin-system.md`, `EchoesVault/pages/product-overview.md`, `EchoesVault/pages/codex-app-server-backend.md`: stale `pluginreg` references corrected to `standardplugins`/`featurebundle`/`runtimebundle`.
+- `README.md`: repository layout updated to list `internal/standardplugins/` and `internal/featurebundle/`.
+
+### Verification (d-verify)
+
+- `make test-unit`: PASS (all packages).
+- `make quality-checks`: PASS (gofmt, modules, build, go vet, goroutine allowlist, regex hot-path, archtest guardrails).
+- `make arch-report`: 11 aligned, 0 extract, 0 exception; `executor.go` at 118 lines.
+- `lipstd check-config` / `routes` against `config/examples/dogfood-local-stub.yaml`: PASS (no API keys required).
+- No client-visible behavior change (internal package relocation only; regression tests green). No DI containers or init registration introduced.

EchoesVault/pages/architecture-overview.md

@@ -18,15 +18,15 @@ Five primary zones:
 4. Official backend & feature plugins (`internal/plugins/backends/`, `internal/plugins/features/`)
 5. Test and operational support (`internal/refbackend/`, `internal/refclient/`, `internal/testkit/`)
 
-Around them: standard distribution assembly (`internal/pluginreg/`, `internal/infra/runtimebundle/`, `internal/stdhttp/`).
+Around them: standard distribution assembly (`internal/standardplugins/`, `internal/featurebundle/`, `internal/infra/runtimebundle/`, `internal/stdhttp/`) plus the explicit registry type in `internal/pluginreg/`.
 
 ## Hexagonal Mapping
 
 - **Domain/policy center:** `pkg/lipapi` + `internal/core/`
 - **Application/use-case orchestration:** executor, routing, continuity, extension pipeline
 - **Driving adapters:** HTTP frontends, CLI, admin/diagnostic surfaces
 - **Driven adapters:** backend plugins, stores, model/catalog providers, tokenizers, metrics/tracing
-- **Composition roots:** `cmd/lipstd/`, `internal/pluginreg/`, `internal/infra/runtimebundle/`, `internal/stdhttp/`
+- **Composition roots:** `cmd/lipstd/`, `internal/standardplugins/`, `internal/infra/runtimebundle/`, `internal/stdhttp/` (with `internal/pluginreg/` providing the registry type)
 
 ## Core Ownership Rules
 

EchoesVault/pages/codex-app-server-backend.md

@@ -129,7 +129,7 @@ The model is **not** passed via CLI flags — it is sent in the `turn/start` JSO
 
 ## Plugin Registration
 
-Registered in `internal/pluginreg/standard_table.go` and `internal/pluginreg/backends_acp_cli.go` as backend ID `openai-codex-app-server` with model prefix `openai/`.
+Registered in `internal/standardplugins/standard_table.go` and `internal/standardplugins/backends_acp_cli.go` as backend ID `openai-codex-app-server` with model prefix `openai/`.
 
 Default inventory models: `auto`, `gpt-5.4`, `gpt-5.3-codex`, `gpt-5.2`.
 

EchoesVault/pages/package-map.md

@@ -62,8 +62,8 @@ status: active
 |---|---|
 | `internal/pluginreg/` | Explicit registry: `NewRegistry`, `RegisterBackend`/`RegisterFrontend`/`RegisterFeature`, `BuildBackend`/`BuildFeatureBundle`, `ValidateBundledFactories`, `EffectiveAPIKeys` |
 | `internal/standardplugins/` | Standard distribution: `InstallStandardBundleOn`, standard frontend/backend/feature tables, per-backend factory helpers, `ResolveUpstreamAPIKeysFromEnv`, `DefaultWireModel` |
-| `internal/featurebundle/` | Feature merge surface: `MergeFeatureSurface`, `BuildFeatureHooks` |
-| `internal/infra/runtimebundle/` | Composes `Built` from config + registrations: executor, stores, HTTP client, health, model, accounting |
+| `internal/featurebundle/` | Feature merge surface: `MergeFeatureSurface` (SDK hook slices only; no `internal/core/hooks`) |
+| `internal/infra/runtimebundle/` | Composes `Built` from config + registrations: executor, stores, HTTP client, health, model, accounting; owns `BuildFeatureHooks` / `hooks.New` |
 | `internal/stdhttp/` | HTTP mounting, auth/principal, security guard, recovery, diagnostics, access logs, `Run`/`RunWithRuntime` |
 
 ## Plugin Packages

EchoesVault/pages/plugin-system.md

@@ -11,7 +11,7 @@ status: active
 
 ## Registration Model
 
-Explicit, static, per-composition-root. No DI containers, no reflection registries, no Go `plugin` package. `internal/pluginreg/` owns standard distribution registration.
+Explicit, static, per-composition-root. No DI containers, no reflection registries, no Go `plugin` package. `internal/pluginreg/` owns the registry type (`NewRegistry`, `RegisterBackend`/`RegisterFrontend`/`RegisterFeature`, `BuildBackend`/`BuildFeatureBundle`); `internal/standardplugins/` owns the standard distribution registration tables and `InstallStandardBundleOn`. Feature merge lives in `internal/featurebundle/`; the hook bus (`hooks.New`, `BuildFeatureHooks`) is constructed in `internal/infra/runtimebundle/`.
 
 Backend registrations declare both credential posture and access scope. `BackendAccessLocalOnly` connectors are allowed only in single-user loopback deployments and are rejected during runtime bundle assembly when `access.mode: multi_user` is active.
 

EchoesVault/pages/product-overview.md

@@ -34,7 +34,7 @@ Universal translation, routing, and control plane for AI clients. Sits between A
 
 ## Standard Distribution (`cmd/lipstd`)
 
-Serves bundled HTTP frontends, routes through canonical [lipapi](canonical-contracts.md) requests/events, wires official backends and feature plugins via explicit registration (`internal/pluginreg/`).
+Serves bundled HTTP frontends, routes through canonical [lipapi](canonical-contracts.md) requests/events, wires official backends and feature plugins via explicit registration (`internal/standardplugins/` tables installed onto an `internal/pluginreg/` registry).
 
 ## Relationship to Python LIP
 

README.md

@@ -84,8 +84,10 @@ Recoverability is defined by the specification bundle: tests, `testdata/` golden
 - `pkg/lipsdk/` - stable plugin SDK contracts and standard distribution requirements.
 - `internal/core/` - runtime orchestration, routing, continuity, secure sessions, hooks/extensions, stream handling, policy, accounting, config, admin, diagnostics, and safety.
 - `internal/plugins/` - bundled frontend, backend, feature, compatibility, and protocol-helper packages.
-- `internal/pluginreg/` - explicit standard bundle registration and backend factory helpers.
-- `internal/infra/runtimebundle/` and `internal/stdhttp/` - runtime assembly and HTTP mounting/serving.
+- `internal/standardplugins/` - standard bundle registration tables, per-backend factory helpers, and `InstallStandardBundleOn`.
+- `internal/featurebundle/` - feature merge surface (`MergeFeatureSurface` over SDK hook slices).
+- `internal/pluginreg/` - explicit per-composition-root registry and backend factory helpers.
+- `internal/infra/runtimebundle/` and `internal/stdhttp/` - runtime assembly (executor, hook bus, stores) and HTTP mounting/serving.
 - `internal/infra/` - logging, HTTP client tuning, metrics, tracing, DB, model catalog/registry, routing health, tokenization/accounting, and auth-event plumbing.
 - `internal/refbackend/`, `internal/refclient/`, `internal/testkit/` - emulators, reference clients, fixtures, stubs, and conformance helpers for tests.
 - `internal/archtest/`, `internal/qa/`, `scripts/`, `.githooks/`, `.github/workflows/` - guardrails and quality automation.

cmd/lipstd/hooks_compose_test.go

@@ -8,7 +8,6 @@ import (
 	"github.com/matdev83/go-llm-interactive-proxy/internal/core/config"
 	"github.com/matdev83/go-llm-interactive-proxy/internal/core/hooks"
 	"github.com/matdev83/go-llm-interactive-proxy/internal/core/routing"
-	"github.com/matdev83/go-llm-interactive-proxy/internal/featurebundle"
 	"github.com/matdev83/go-llm-interactive-proxy/internal/infra/runtimebundle"
 	"github.com/matdev83/go-llm-interactive-proxy/internal/pluginreg"
 	"github.com/matdev83/go-llm-interactive-proxy/internal/standardplugins"
@@ -41,7 +40,7 @@ func TestFeatureHooksFromReferenceConfig_chainsAndPassThrough(t *testing.T) {
 	}
 
 	regs := config.RegistrationsFromConfig(cfg)
-	hookCfg, _, err := featurebundle.BuildFeatureHooks(reg, regs)
+	hookCfg, _, err := runtimebundle.BuildFeatureHooks(reg, regs)
 	if err != nil {
 		t.Fatalf("feature hooks: %v", err)
 	}
@@ -83,7 +82,7 @@ func TestFeatureHooksFromRegistrations_unknownEnabledFeature(t *testing.T) {
 	t.Parallel()
 	reg := testRegistryWithStdBundle(t)
 
-	_, _, err := featurebundle.BuildFeatureHooks(reg, []lipsdk.Registration{
+	_, _, err := runtimebundle.BuildFeatureHooks(reg, []lipsdk.Registration{
 		{Kind: lipsdk.PluginKindFeature, ID: "unknown-feature", Enabled: true},
 	})
 	if err == nil {
@@ -104,7 +103,7 @@ func TestNewBootstrapApp_withComposedHooks(t *testing.T) {
 		t.Fatalf("model_aliases: %v", err)
 	}
 	regs := config.RegistrationsFromConfig(cfg)
-	hookCfg, _, err := featurebundle.BuildFeatureHooks(reg, regs)
+	hookCfg, _, err := runtimebundle.BuildFeatureHooks(reg, regs)
 	if err != nil {
 		t.Fatalf("feature hooks: %v", err)
 	}

docs/adr/0001-registry-driven-composition.md

@@ -20,3 +20,7 @@ The standard distribution must stay statically linked while avoiding central `sw
 - Duplicate ids must be rejected at registration time (see registry validation tasks).
 - Operator-facing behavior for routing cooldown and observability is configured in YAML (`routing.health`, executor logging) and documented in the main README “Current state” section and [`docs/routing-health-circuit-breaker.md`](../routing-health-circuit-breaker.md).
 - Architecture budgets and import guardrails are enforced in [`internal/archtest`](../../internal/archtest/guardrails_test.go) and ADR 0005.
+
+## Updates
+
+- **2026-07-08 (arch review final closure):** The standard bundle registration tables (`standard_table.go`, `*_install.go`) and `InstallStandardBundleOn` moved from `internal/pluginreg` to `internal/standardplugins`. The registry value type (`pluginreg.Registry`, `NewRegistry`, `BuildBackend`, `BuildFeatureBundle`) remains in `internal/pluginreg`. Feature merge lives in `internal/featurebundle` (`MergeFeatureSurface` over SDK hook slices); `BuildFeatureHooks` and `hooks.New` construction moved to `internal/infra/runtimebundle` (composition root). The registry-driven composition decision above is unchanged — only the package locations of the standard tables and hook-bus construction narrowed. See `docs/architecture.md` and `testdata/architecture/hexagonal_migration_baseline.json` (schema v3) for the current map.

docs/adr/0005-architecture-guardrails-and-complexity-budgets.md

@@ -16,7 +16,7 @@ Stage two review ([`stage2_code_review.md`](../../.kiro/specs/archive/go-core-re
    - `internal/stdhttp`
    - `internal/infra/runtimebundle`
 
-2. **No `init()` in the standard bundle registration path** — Production registration code under `internal/pluginreg` and `cmd/lipstd` must not use `func init()`. The standard binary should own an explicit `*pluginreg.Registry` (`NewRegistry` + `InstallStandardBundleOn(reg)` + validation) and thread that registry into `runtimebundle.Build` / HTTP wiring. Composition roots and wiring layers must not depend on package-level default registry state (see ADR 0001 and `internal/archtest`). Test-only `init()` in `*_test.go` remains allowed.
+2. **No `init()` in the standard bundle registration path** — Production registration code under `internal/pluginreg`, `internal/standardplugins`, and `cmd/lipstd` must not use `func init()`. The standard binary should own an explicit `*pluginreg.Registry` (`NewRegistry` + `InstallStandardBundleOn(reg)` + validation) and thread that registry into `runtimebundle.Build` / HTTP wiring. Composition roots and wiring layers must not depend on package-level default registry state (see ADR 0001 and `internal/archtest`). Test-only `init()` in `*_test.go` remains allowed.
 
 3. **Core import boundary** — `internal/core` must not depend on `internal/plugins/...` (enforced by `go list` dependency tests in `internal/core/runtime`).