refactor: extract platform device inventory runtime

[thymikee]

Summary

Extract device inventory behind request-bound contracts and six implementation-lazy platform packages.

Migrate the devices command and legacy local discovery consumers to the composed inventory gateway, preserve provider-first behavior and platform parity, delete the superseded discovery routes, and add structural/atomicity gates for the package boundary. Also isolate Node integration device claims after the full gate exposed host-global test state.

Part of #1696.

Validation

• pnpm check:affected --run
• 402 test files / 3,688 tests passed under affected coverage
• changed-line coverage: 193/243 (79.42%)
• Node integration: 53 passed, 8 skipped
• layering: 105 structural tests and repository guard passed
• fallow, build, package verification, integration progress, and replay compatibility passed
• adversarial Claude Opus review plus focused Sonnet closure; no remaining P0/P1 findings

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-10 10:52 UTC

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.04 MB	2.05 MB	+10.6 kB
JS gzip	659.6 kB	664.0 kB	+4.3 kB
npm tarball	797.0 kB	801.0 kB	+3.9 kB
npm unpacked	2.78 MB	2.79 MB	+11.6 kB

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	29.1 ms	29.2 ms	+0.1 ms
CLI --help	68.2 ms	68.8 ms	+0.6 ms

Top changed chunks:

Chunk	Raw diff	Gzip diff
dist/src/sdk-batch-runner.js	+6.4 kB	+2.1 kB
dist/src/internal/daemon.js	+3.8 kB	+1.0 kB
dist/src/context.js	+662 B	+283 B
dist/src/session.js	+614 B	+192 B
dist/src/src2.js	+9 B	+8 B

[thymikee]

Reviewed exact head ae15898. Code review is clean: the devices descriptor now has one inventory execution shape, request routing binds the provider-authoritative/request-scoped gateway, local family mechanics remain lazy, legacy discovery routes are removed, and planted structural cases prove atomicity. Exact-head Android emulator and iOS simulator smoke exercise the migrated inventory/target-resolution path; provider/family projection is covered by contract/integration suites. The PR is not merge-ready only because required Coverage is red: the log shows no failed assertion, but Vitest could not terminate the unchanged scripts/fuzz/corpus-replay.test.ts fork and emitted an unhandled worker-exit error. This appears to be a harness/infrastructure flake, not a source regression, but Coverage must be rerun green before readiness and no ready-for-human label should be applied while it remains red. Residual assurance: the body records planted-red structural evidence but not red-before/revert evidence for all behavioral parity tests.

[thymikee]

Exact head ae15898 is now ready for human review. The required Coverage rerun passed; all 31 non-skipped checks are green, the branch is MERGEABLE/CLEAN, and the earlier clean code/evidence verdict is unchanged. ready-for-human applied.

[thymikee]

Agreed. The committed stack has genuine planted-negative structural evidence in platform-execution.test.ts (legacy and neither-route violations), the platform package policy/source/repository tests (back-edges, eager evaluation, host probing, and untracked production files), and platform-module.test.ts (missing/duplicate/unknown family ownership). I’m not claiming equivalent red-before proof for the behavioral parity suite: provider-authoritative empty inventory, selector parity, Apple fast paths, six-family discovery, doctor/sharding consumers, and device smoke are green parity evidence only. The claims-directory lifecycle test is described as planted, but no failing pre-fix output was preserved, so it is not independently red-proven. The residual assurance note therefore stands without implying a code defect.

[thymikee]

Claude’s final stacked-diff review found one remaining P1 in the devices slice: migrated Apple inventory had bypassed the scoped Apple tool provider by invoking raw xcrun through the generic host command port. Fixed in f4c646b with a closed AppleToolHost contract, an intrinsically lazy scoped-provider adapter, exact simctl/devicectl/xctrace inventory migration, cancellation propagation, and an R13 AST rule with a planted raw-xcrun violation. Also extracted the shared lazy host toolchain preparer for the dependent logs fix. Validation: focused 25/25; structural planted gate green after observed red; full pnpm check:affected --run green, including 3,692 affected coverage tests and 80.47% changed-line coverage. No CLI/docs/skills changes.

[thymikee]

Exact-head re-review at f4c646bd: not ready; one P1 remains. The new closed Apple tool port correctly routes full AppleToolProvider objects, preserves cancellation/laziness, and structurally blocks raw generic xcrun. But the still-supported function-shaped AppleToolCommandExecutor is normalized through createLocalAppleToolProvider, inheriting local whichCmd; inventory calls appleTools.isXcrunAvailable() before provider execution. On a host without local xcrun, a valid scoped remote executor is rejected as TOOL_MISSING and never called. Make availability provider-owned (or narrow/remove the function form at this seam) and add a request-router/devices regression with function provider + unavailable local xcrun proving no local probe. Separately, exact-head iOS Smoke is confirmed red at alert wait 5000; it is outside the inventory delta but not a documented flake and has no same-head retry/main comparison, so it remains unclassified owner action. The existing ready-for-human label must be removed pending the P1 fix and green evidence.

[thymikee]

Exact-head follow-up at f1e2425ca3754f12476e048fcd04c6ef516c652b: not ready; the function-provider P1 remains despite green CI. normalizeAppleToolProvider still turns a function-shaped AppleToolCommandExecutor into createLocalAppleToolProvider({ runCommand }), which inherits local whichCmd; createAppleToolHost().isXcrunAvailable() calls that local availability probe, and Apple inventory can therefore reject before dispatching to a valid scoped remote executor when local xcrun is absent. The new commit covers abort-reason preservation only, and the tests still use full provider objects rather than the request-router/devices function-provider route. Add the requested function provider + unavailable local xcrun regression and make availability provider-owned (or remove/narrow the function form at this seam). The prior iOS Smoke failure is now cleared; all current checks are green, the branch is MERGEABLE/CLEAN, and no label is applied.

[thymikee]

Thermo review follow-up is now on ab048fbea.

Implemented:

• removed the operational InventoryUse gateway argument while retaining platformExecution/inventoryUse on the descriptor as ADR 0019’s sole cutover declaration;
• replaced the bespoke repo-wide devices regex test with an OXC AST R13 policy and planted alias/shadow/legacy-route cases;
• removed spelling/name heuristics from the platform package/composition gates and kept precise eager-loader/ambient-authority checks;
• narrowed each family inventory module to the host capabilities it actually uses (web is host-free);
• made the composed gateway the sole projection owner and rebuilt test gateways through production composition;
• moved the composed gateway type to contracts and removed the dispatch pass-through;
• centralized Android ADB/device semantics, preserving stderr-only transport classification and restoring server_version_mismatch;
• fixed Vega cancellation/context propagation and retained typed listedSerials doctor evidence;
• removed the ambiguous bare-function Apple tool provider form.

I did not delete the descriptor discriminant or assertCommandPlatformExecution: ADR 0019 explicitly requires the descriptor as the command-atomic cutover declaration, and the validator still protects future runtime-use declarations from malformed duplicate/overlapping shapes.

Seen-red evidence covered provider-policy leakage, web host eagerness, stale runtime-use signatures, the handwritten chooser, Android stdout false positives, swallowed cancellation, lost Vega evidence, and planted structural violations.

Validation: pnpm check:affected --run passed all runnable checks; 442 files / 4,002 tests in affected coverage; changed-line coverage 229/277 (82.67%); layering 114/114; typecheck, package verification, integration-node, fallow, lint, format, replay compatibility all green. Claude -p reviewed the exact f1e2425ca..ab048fbea diff and returned NO P0/P1 BLOCKERS.

[thymikee]

Exact-head readiness re-review at ab048fbea351d1c80fadf29b721185e63074085a: clean. The prior P1 is fixed by removing the bare-function Apple tool provider form end-to-end from the resolver, scoped-provider contract, and normalizer, making availability provider-owned through a full AppleToolProvider. No new actionable finding was confirmed in the targeted delta. The branch is CLEAN/MERGEABLE; all substantive checks and iOS, Android, macOS, and Linux device smokes are green.

Residual assurance: rejection of the removed function form is enforced by the narrowed type surface and green typecheck rather than a dedicated planted-negative compile gate; the surviving full-provider runtime test is valid for the supported route but would not itself fail on the former union. No label applied.