refactor: move platform provider composition out of daemon

[thymikee]

Summary

Move request-scoped provider composition out of src/daemon and into root runtime composition. The daemon now consumes one neutral provider scope while exact-owner gating, wrapper order, inherited replay scope, request identity, and fail-closed provider behavior remain unchanged.

This is PR 1/3 in the #1739 terminal daemon-platform stack. It removes 15 of the 38 concrete-platform edges measured on main and also relocates the remaining neutral request/boot/install vocabulary to contracts.

Validation

Provider routing, nested replay-scope, request-context, and fail-closed parity tests pass. Typecheck, layering, fallow, build/package, Node integration, and provider integration passed on the complete stack. The full affected run reached 3,429/3,430 related tests; its sole Apple-runner concurrency timeout passed in isolation in 149 ms.

57 files are touched across the complete stack; this PR is the provider-composition slice. No docs or skills changed because the public command surface and behavior are unchanged.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.47 MB	2.47 MB	+775 B
JS gzip	829.6 kB	830.2 kB	+581 B
npm tarball	953.0 kB	953.5 kB	+507 B
npm unpacked	3.30 MB	3.31 MB	+895 B

npm unpacked components

Component	Base	Current	Diff
JS / dist source	2.62 MB	2.62 MB	+895 B
Apple runner source/project	581.1 kB	581.1 kB	0 B
macOS helper source	54.8 kB	54.8 kB	0 B
Android helper artifacts	0 B	0 B	0 B
Other package files	45.3 kB	45.3 kB	0 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	21.4 ms	21.1 ms	-0.3 ms
CLI --help	58.8 ms	55.4 ms	-3.4 ms

Top changed chunks:

Chunk	Raw diff	Gzip diff
dist/src/internal/daemon.js	-3.5 kB	-708 B
dist/src/session2.js	+211 B	+158 B
dist/src/platform-runtime-operation-host.js	-13 B	+1 B

Top changed packed files

Packed file	Base	Current	Diff
dist/src/request-providers.js	0 B	4.1 kB	+4.1 kB
dist/src/internal/daemon.js	110.7 kB	107.2 kB	-3.5 kB
dist/src/platform-runtime.js	12.0 kB	12.3 kB	+307 B
dist/src/boot-diagnostics.js	3.8 kB	3.5 kB	-258 B
dist/src/session2.js	215.5 kB	215.7 kB	+211 B
dist/src/sdk-contracts.d.ts	18.1 kB	18.3 kB	+177 B
dist/src/provider.js	367 B	300 B	-67 B
dist/src/install-source.d.ts	623 B	566 B	-57 B
dist/src/web.js	1.2 kB	1.2 kB	+17 B
dist/src/platform-runtime-network-web-transport.js	492 B	479 B	-13 B

[thymikee]

P2: govern the new provider-composition owner instead of creating an unprotected second composition seam. src/platform-runtime-request-providers.ts now owns the cross-family resolver table, wrapper ordering, default Web construction, and concrete platform imports, while ADR-0019 and R13 name/protect only src/platform-runtime.ts as the canonical composition root. The move preserves behavior, but future provider additions can now smear platform composition outside the enforced owner. Make this an explicitly governed submodule of the canonical root and extend R13 with planted-red coverage, or amend the ADR and executable policy to name this second composition owner. Until then, the slice is not ready-for-human despite otherwise clean routing and green checks in progress.

[thymikee]

Addressed in 7389a45. Provider composition now lives in the governed src/platform-runtime/request-providers.ts submodule of the canonical root, and R13 has planted-red coverage preventing another ungoverned composition owner. The exact-slice duplicate imports and unused type re-exports reported by CI are also fixed; format, lint, and Fallow pass locally.

[thymikee]

Addressed in 0409dac. Provider composition now lives in the governed src/platform-runtime/request-providers.ts submodule of the canonical root, and R13 has planted-red coverage preventing another ungoverned composition owner. Exact-slice duplicate imports, unused type re-exports, and the coverage-only shutdown test mock are fixed; format, lint, Fallow, and the exact failed test pass locally.

[thymikee]

Re-reviewed the rewritten head 0409dac62efa3280885670e4cf9dc39f3a5b35c1. The prior composition-boundary finding remains resolved. The only new delta updates a daemon-lifecycle test mock to supply the newly required createRequestPlatformProviders seam; it transparently executes the supplied task and does not change production behavior or weaken the composition/R13 guarantees. I found no new code issue. Exact-head substantive checks restarted and remain pending.

[thymikee]

Exact-head evidence is now complete. The reviewed code head is unchanged, and every substantive check is green: repository guards, type/package, both coverage shards, integration, lint/format, bundle size, CodeQL, and Android/Linux/iOS/macOS smoke. The only skipped entry is the expected build-cache matrix placeholder. No code or evidence blocker remains; this is merge-ready.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-27 11:11 UTC