{
  "id": "page:docs-specs-platform-gaps-15-private-isolation-rename",
  "_kind": "Page",
  "_file": "wiki/docs/specs/platform-gaps/15-private-isolation-rename.md",
  "_cluster": "wiki",
  "attributes": {
    "nodeKind": "Page",
    "sourcePath": "docs/specs/platform-gaps/15-private-isolation-rename.md",
    "sourceKind": "repo-docs",
    "title": "Spec 15 — Private isolation & rename (WP-RN-*)",
    "displayName": "Spec 15 — Private isolation & rename (WP-RN-*)",
    "slug": "docs/specs/platform-gaps/15-private-isolation-rename",
    "articlePath": "wiki/docs/specs/platform-gaps/15-private-isolation-rename.md",
    "article": "\n# Spec 15 — Private isolation & rename (WP-RN-*)\n\nDate: 2026-09-27 · Status: Gate-B draft · Binding decisions: **D17–D21** (`docs/specs/platform-gaps/00-intent.md:38-46`), constrained by D10 (break freely), D14 (public-facing branding out of scope), D15 (attribution), and intent acceptance criterion 7 (`00-intent.md:63`).\n\nInputs consumed in full: R1 `research/fabric-current-state.md`, R3 `research/packaging-state.md`, R4 `research/delta-map.md`, Gate-A synthesis `research/synthesis-adoption-proposal.md`; pre-existing rename planning **absorbed, not re-derived**: `docs/adapters/terminology-and-structure-gaps/{README,package-renames,binary-renames,env-var-renames,directory-moves,code-identifier-renames}.md` and `docs/blueprints-rename/README.md`. Fresh evidence in this spec was re-verified at fabric HEAD `5e46b998e`.\n\nThe name-mapping matrix in §3 is a **decision table**: it is proposed here and **locked verbatim at Gate B** (D18, D21). After Gate B no work package — in this spec or in specs 10/20/30/40/50 — may introduce a package, binary, env prefix, directory, or chart/CRD name that is not in (or derived by the stated rules from) this table.\n\n---\n\n## 1. The two-repo hard split (D17)\n\n### 1.1 Current topology (evidence)\n\n- The checked-out repo is the **private mirror `a5c-ai/fabric`**; its `publish.yml` header states: \"Deploy pipeline of the private mirror a5c-ai/fabric … npm publishing, release tags and the docs site stay in the public a5c-ai/babysitter repository and are deliberately absent here\" (`.github/workflows/publish.yml:3-6`; R3 §1.1).\n- npm publication of the 43 public packages under `@a5c-ai/*` runs from the **public** repo's copy of the publish workflow (R3 inferred finding 4, `research/packaging-state.md:365-367`). Release tags follow `babysitter/<branch>/v<version>` (`.github/workflows/release-tags.yml:1-14`; R3 §1.1).\n- The publishable inventory is derived at run time by `scripts/lib/publishable-packages.cjs:122-161` (selector at :136-137: workspace member, `private !== true`, `publishConfig.access === \"public\"`) — 43 packages, all `@a5c-ai/*`, lockstep 6.0.x (R3 §1.1, `research/packaging-state.md:28-32`).\n\n### 1.2 Target topology (binding, D17)\n\n| Repo | Role after the split | Names | Registry |\n|---|---|---|---|\n| public `a5c-ai/babysitter` | Open, maintained, **untouched by this effort** | keeps `@a5c-ai/*` npm names, `babysitter/<branch>/v*` tags, docs site | public npmjs, exactly as today |\n| private `a5c-ai/fabric` | The isolated private product; **source of truth** for all new work incl. the entire t3code migration | renamed per §3 matrix, new scope §2 | GCP Artifact Registry npm only (§4) |\n\nInvariants (mirror intent acceptance criterion 7, `00-intent.md:63`):\n\n1. **No work package in any spec alters the public repo** — not its package names, not its publishing, not its tags, not its workflows.\n2. Mirroring public→private **stops now**; fabric ceases to be a mirror and becomes a first-class diverged repository.\n3. Upstream public fixes flow **only** by opportunistic cherry-pick (one-way, public→private). Private work never flows back.\n4. Renamed packages are **never** published to public npmjs (D19; guards in §4.3).\n\n### 1.3 Stop-mirror mechanics\n\n- Terminate the repo-level sync that maintains fabric as a mirror of babysitter (whatever transport it uses — scheduled workflow, push mirror, or manual sync; the tree itself carries no sync workflow, consistent with mirroring being configured at the hosting level, `.github/workflows/publish.yml:3-6` describing fabric as \"mirror\").\n- Rewrite the `publish.yml` header block (`publish.yml:3-6`) to declare fabric the private product repo, not a mirror.\n- Add `upstream = https://github.com/a5c-ai/babysitter` as a **fetch-only** remote convention; CI and branch protection must reject any push remote pointing at the public repo (§ WP-RN-02).\n- Retag discipline: fabric's release tags move to `fabric/<branch>/v<version>` so cherry-picked commits can never collide with the public `babysitter/<branch>/v*` namespace (`release-tags.yml:1-14`; § WP-RN-07).\n\n### 1.4 Cherry-pick-only intake workflow\n\n- Intake is **pull-based and opportunistic**: a maintainer reviews `git log upstream/main` at their own cadence; there is no scheduled auto-merge and no shared history requirement going forward.\n- Every intake lands as a PR labeled `upstream-intake`, carrying: upstream SHA(s), the path map applied (old `@a5c-ai`/directory names → §3 names), and a statement of what was deliberately dropped.\n- **Path translation**: after rename phase RN-1 the package.json names differ; after phase RN-3 the directories differ. Intake before RN-3 is a plain `git cherry-pick` plus name fix-ups; after RN-3 it requires path rewriting (`git format-patch` + `git apply -p… --directory=<new>` or rename-aware `cherry-pick -X find-renames`). Consequence (binding sequencing rule): any **bulk** upstream intake still wanted is scheduled before WP-RN-10 executes; afterwards intake is expected to shrink to targeted fixes, matching D17's \"opportunistic\" wording.\n- Conflict policy: on conflict, fabric's version wins by default — divergence is licensed (D17 \"free to diverge in implementation\"); the intake PR documents dropped hunks instead of contorting fabric to stay merge-clean.\n\n### 1.5 Divergence policy\n\n- Fabric may freely diverge in implementation, dependencies, and architecture (D17). The t3code migration (spec 10) and **all** new work land fabric-only.\n- The public repo's API/behavior is **not** a compatibility constraint on fabric (D10 break-freely reinforces this); the only shared obligation is the one-way fix intake of §1.4.\n- Security fixes are the priority intake class: journal/replay/trust findings fixed publicly (the F-01…F-08 cluster of `20-functionality-coverage.md`, per synthesis §3) must be evaluated for intake within the intake owner's next review pass, and vice-versa fabric-side fixes to that cluster are **not** pushed upstream (they may be re-implemented publicly by whoever maintains the public repo, outside this effort).\n\n---\n\n## 2. New npm scope (D18/D19 — proposed decision)\n\n**Decision: the new scope is `@fabricstack`** (re-locked by owner decision on 2026-09-28, see the amendment note below; final lock at Gate B).\n\nRationale:\n- **Neutral and descriptive** (D18: \"no mythology\"): \"the fabric stack\" names the product's platform layer; it carries no character/myth name and no `a5c` corporate marker.\n- **Guard-friendly**: it shares no prefix with `@a5c-ai`, so publish-isolation checks (§4.3) and code greps can key on the scope string unambiguously; a stray `@a5c-ai/` import after cutover is mechanically detectable.\n- **Matches the repo** (`fabric`) without being the bare word: the bare `@fabric` scope is generic and collision-prone on public npm (the `fabric` package name is long-taken there), while `fabricstack` is specific enough to defensively register.\n- **Free on public npmjs** (verified read-only on 2026-09-28, evidence in `phase0/scope-relock.md`): `GET https://registry.npmjs.org/-/org/fabricstack/user` → `404`, `GET https://registry.npmjs.org/fabricstack` → `404`, `GET https://registry.npmjs.org/-/v1/search?text=%40fabricstack&size=20` → `total: 0` (no `@fabricstack/*` package). Calibration on the same day: the same probes for `agentfabric` return `200` / `200` / 5 results.\n- **Registry-independent**: on GCP Artifact Registry any scope works, but the scope must still be defensively registerable on npmjs to prevent squatting (§4.3 G4) — which the previous choice turned out not to be.\n\nAlternatives considered:\n- `@agentfabric` — the original proposal; **rejected on 2026-09-28: taken.** Third-party-owned on public npmjs (the scoped package `sdk` 1.0.1, maintainer `defimessiah`, created 2026-03-18; unscoped `agentfabric` 0.0.2, maintainer `mdirshadengineer`, created 2026-04-25; `/-/org/agentfabric/user` → 200), so the G4 premise (\"defensively registerable\") is false and any out-of-tree consumer without the AR routing line would resolve our names against a stranger's packages (dependency confusion).\n- `@fabric-platform` — rejected: taken (`/-/org/fabric-platform/user` → 200 on 2026-09-28).\n- `@a5c-platform` — rejected: keeps the corporate `a5c` marker in a surface D18 wants neutral, and its shared `a5c` prefix with the public scope weakens grep-based isolation guards.\n- `@fabric` — rejected: generic; high squat/collision risk on public npm; weak as a guard token (matches prose and the html canvas library ecosystem).\n- `@sovereignty` / `@sovereign` — rejected: leaks the company brand into the neutral private surface and contradicts the spirit of D14 (public-facing branding out of scope) by minting a brand-adjacent name.\n\n> **Amendment (2026-09-28).** This section originally proposed `@agentfabric`. While preparing the defensive npmjs registration (§4.3 G4, WP-RN-04) the scope was found to be third-party-owned on public npmjs (its scoped package `sdk` 1.0.1 by `defimessiah`, published 2026-03-18; unscoped `agentfabric` by `mdirshadengineer`). At breakpoint `phase0.npmjs-org` on 2026-09-28 the owner chose \"Re-lock to `@fabricstack`\" over keeping the colliding scope. The re-lock changed the single constant (`fabric.privateScope` in the root `package.json`), the root `.npmrc` routing line, the guard fixtures, the smoke package and every scope mention in specs 10/15/20/30/40/50 and the phase-0 records; the Artifact Registry repository itself is scope-agnostic and was not changed. Record: `docs/specs/platform-gaps/phase0/scope-relock.md`. The `fabricstack` org registration on npmjs remains an owner action (`phase0/g4-npmjs-org-runbook.md`).\n\nEnv-var master prefix and data-dir token derived from the same decision: prefix families per component (§3.4) with `FABRIC_` reserved for genuinely platform-wide variables, and the runtime data directory token `.fabric/` (§3.5). Binary names are per-component words, not scope-prefixed (§3.3) — a CLI named `fabricstack-…` for every tool would be hostile; t3code itself ships `t3` (R3 §2.1).\n\n---\n\n## 3. The complete neutral-name mapping matrix (D18) — decision table, locked at Gate B\n\nConventions used below:\n- Every current name/dir/bin is CONFIRMED from the live inventory (`scripts/lib/publishable-packages.cjs` executed at HEAD: 43 packages; bins read from each `manifestPath`; private workspaces read from root `workspaces` globs). The 9 `packages/` subsystems named by the intent (`00-intent.md:50`) plus `apps/commander` are all explicitly present.\n- **Single-bin policy**: each package ships at most the bins listed — every legacy alias bin is dropped, not aliased. The public repo keeps the old bins for old users (D17), so the private train needs no deprecation shims (D10). This resolves the `babysitter` bin collision (both `@a5c-ai/babysitter` and `@a5c-ai/babysitter-sdk` declare bin `babysitter` — `packages/babysitter/package.json:7-9` vs `packages/babysitter-sdk/package.json:9-14`; R3 §1.6, `research/packaging-state.md:176-178`) **and** the two further collisions confirmed at HEAD: `@a5c-ai/babysitter-sdk` also declares bins `adapters` and `adapters-hooks`, colliding with `@a5c-ai/adapters` (bin `adapters`) and `@a5c-ai/hooks-adapter-cli` (bin `adapters-hooks`).\n- D18's example vocabulary is fully covered: orchestrator(-sdk)=babysitter(-sdk), control-plane=kradle, agent-runtime=genty, memory=kip-sdk, catalog=atlas, harness-gateway=adapters-gateway, model-gateway=transport-adapter, trust=trust-core, console=client/UI family, operator=kradle-installer, process-library=`library/`, packages=the `packages/` root (unchanged).\n- The pre-existing plan `package-renames.md`/`directory-moves.md` targeted `@a5c-ai/adapters-{feature}` under `packages/adapters/` — the **structural** part of that plan (everything under one umbrella; hooks under `adapters/hooks/`) is already landed at HEAD (the live inventory shows all adapter dirs under `packages/adapters/…`), and this matrix keeps that structure while replacing the umbrella word per D18. The `binary-renames.md` backward-compat alias guidance is superseded by the single-bin policy above (it predates D17's two-repo model). The `env-var-renames.md` `ADAPTER_* → AGENT_MUX_*` mapping is adopted verbatim (§3.4). `code-identifier-renames.md` and `docs/blueprints-rename/README.md` are absorbed into phases RN-4 (§5, WP-RN-11).\n\n### 3.1 Publishable packages (all 43)\n\n| # | Current package (dir) | Neutral name | New npm package | Bin(s) | Env prefix | New directory |\n|---|---|---|---|---|---|---|\n| 1 | `@a5c-ai/babysitter` (`packages/babysitter`) — bin `babysitter` | orchestrator metapackage | `@fabricstack/orchestrator` | `orchestrator` | `ORCHESTRATOR_` | `packages/orchestrator/meta` |\n| 2 | `@a5c-ai/babysitter-sdk` (`packages/babysitter-sdk`) — bins `babysitter-sdk`,`babysitter`,`babysitter-mcp-server`,`adapters-hooks`,`adapters` | orchestrator SDK | `@fabricstack/orchestrator-sdk` | `orchestrator-sdk`, `orchestrator-mcp` (three duplicate/colliding bins dropped) | `ORCHESTRATOR_` | `packages/orchestrator/sdk` |\n| 3 | `@a5c-ai/babysitter-observer-dashboard` (`packages/observer-dashboard`) — bin `babysitter-observer-dashboard` | run observer | `@fabricstack/observer` | `observer` | `OBSERVER_` | `packages/observer` |\n| 4 | `@a5c-ai/adapters` (`packages/adapters/sdk`) — bin `adapters` | harness SDK | `@fabricstack/harness-sdk` | `harness` | `AGENT_MUX_` | `packages/harness/sdk` |\n| 5 | `@a5c-ai/adapters-cli` (`packages/adapters/cli`) | harness CLI/e2e host | `@fabricstack/harness-cli` | — (none today) | `AGENT_MUX_` | `packages/harness/cli` |\n| 6 | `@a5c-ai/adapters-codecs` (`packages/adapters/codecs`) | harness codecs | `@fabricstack/harness-codecs` | — | `AGENT_MUX_` | `packages/harness/codecs` |\n| 7 | `@a5c-ai/adapters-gateway` (`packages/adapters/gateway`) | harness gateway | `@fabricstack/harness-gateway` | — | `AGENT_MUX_` | `packages/harness/gateway` |\n| 8 | `@a5c-ai/adapters-harness-mock` (`packages/adapters/harness-mock`) — bins `adapters-harness-mock`,`mock-harness` | mock harness | `@fabricstack/harness-mock` | `harness-mock` | `AGENT_MUX_` | `packages/harness/mock` |\n| 9 | `@a5c-ai/adapters-observability` (`packages/adapters/observability`) | harness observability | `@fabricstack/harness-observability` | — | `AGENT_MUX_` | `packages/harness/observability` |\n| 10 | `@a5c-ai/comm-adapter` (`packages/adapters/core`) | harness core | `@fabricstack/harness-core` | — | `AGENT_MUX_` | `packages/harness/core` |\n| 11 | `@a5c-ai/config-adapter` (`packages/adapters/config`) | harness config | `@fabricstack/harness-config` | — | `AGENT_MUX_` | `packages/harness/config` |\n| 12 | `@a5c-ai/launch-adapter` (`packages/adapters/launch`) | harness launch | `@fabricstack/harness-launch` | — | `AGENT_MUX_` | `packages/harness/launch` |\n| 13 | `@a5c-ai/policy-adapter` (`packages/adapters/policy`) | harness policy | `@fabricstack/harness-policy` | — | `AGENT_MUX_` | `packages/harness/policy` |\n| 14 | `@a5c-ai/tasks-adapter` (`packages/adapters/tasks`) — bins `adapters-tasks`,`tasks-adapter` | harness tasks | `@fabricstack/harness-tasks` | `harness-tasks` | `AGENT_MUX_` | `packages/harness/tasks` |\n| 15 | `@a5c-ai/tools-adapter` (`packages/adapters/tools`) | harness tools | `@fabricstack/harness-tools` | — | `AGENT_MUX_` | `packages/harness/tools` |\n| 16 | `@a5c-ai/triggers-adapter` (`packages/adapters/triggers`) — bins `adapters-triggers`,`triggers-adapter` | harness triggers | `@fabricstack/harness-triggers` | `harness-triggers` | `AGENT_MUX_` | `packages/harness/triggers` |\n| 17 | `@a5c-ai/channels-adapter` (`packages/adapters/channels`) — bins `adapters-channels`,`mcp-channels` | harness channels | `@fabricstack/harness-channels` | `harness-channels` | `AGENT_MUX_` | `packages/harness/channels` |\n| 18 | `@a5c-ai/extensions-adapter` (`packages/adapters/extensions`) — bins `adapters-extensions`,`extensions-adapter` | harness extensions | `@fabricstack/harness-extensions` | `harness-extensions` | `AGENT_MUX_` | `packages/harness/extensions` |\n| 19 | `@a5c-ai/transport-adapter` (`packages/adapters/transport`) — bins `adapters-transport-proxy`,`adapters-proxy` | **model gateway** (it is the model proxy with the attestation seam, R1 §3.1) | `@fabricstack/model-gateway` | `model-gateway` | `MODEL_GATEWAY_` (today `AGENT_MUX_PROXY_*`, `packages/adapters/transport/src/config.ts:47`) | `packages/model-gateway` |\n| 20 | `@a5c-ai/hooks-adapter-core` (`packages/adapters/hooks/core`) | harness hooks core | `@fabricstack/harness-hooks-core` | — | `AGENT_MUX_` | `packages/harness/hooks/core` |\n| 21 | `@a5c-ai/hooks-adapter-cli` (`packages/adapters/hooks/cli`) — bins `adapters-hooks`,`a5c-hooks-adapter` | harness hooks CLI | `@fabricstack/harness-hooks-cli` | `harness-hooks` | `AGENT_MUX_` | `packages/harness/hooks/cli` |\n| 22–33 | `@a5c-ai/hooks-adapter-{antigravity,claude,codex,copilot,cursor,gemini,genty,hermes,oh-my-pi,openclaw,opencode,pi}` (`packages/adapters/hooks/adapter-<h>`) | per-harness hook adapters (12) | `@fabricstack/harness-hooks-<h>` — third-party harness ids (`claude`, `codex`, …) are product names, not mythology, and stay; the fabric-own id `genty` becomes `agent-runtime`: `@fabricstack/harness-hooks-agent-runtime` | — | `AGENT_MUX_` | `packages/harness/hooks/adapter-<h>` (genty dir → `adapter-agent-runtime`) |\n| 34 | `@a5c-ai/genty` (`packages/genty/cli`) — bin `genty` | agent-runtime CLI | `@fabricstack/agent-runtime-cli` | `agent-runtime` | `AGENT_RUNTIME_` | `packages/agent-runtime/cli` |\n| 35 | `@a5c-ai/genty-core` (`packages/genty/core`) | agent-runtime core (session/turn loop) | `@fabricstack/agent-runtime-core` | — | `AGENT_RUNTIME_` | `packages/agent-runtime/core` |\n| 36 | `@a5c-ai/genty-platform` (`packages/genty/platform`) | agent-runtime platform (harness/orchestration wiring) | `@fabricstack/agent-runtime-platform` | — | `AGENT_RUNTIME_` | `packages/agent-runtime/platform` |\n| 37 | `@a5c-ai/genty-runtime` (`packages/genty/runtime`) | agent-runtime engine | `@fabricstack/agent-runtime-engine` | — | `AGENT_RUNTIME_` | `packages/agent-runtime/engine` |\n| 38 | `@a5c-ai/genty-tui` (`packages/genty/tui`) — bin `adapters-tui` | console TUI | `@fabricstack/console-tui` | `console-tui` | `CONSOLE_` | `packages/console/tui` |\n| 39 | `@a5c-ai/genty-ui` (`packages/genty/ui`) | console UI components (the tested hook-API surface, R4 §C; parity bar for T-24) | `@fabricstack/console-ui` | — | `CONSOLE_` | `packages/console/ui` |\n| 40 | `@a5c-ai/atlas` (`packages/atlas`) — bins `atlas`,`a5c-atlas` | catalog (knowledge graph) | `@fabricstack/catalog` | `catalog` | `CATALOG_` | `packages/catalog` |\n| 41 | `@a5c-ai/trust-core` (`packages/trust-core`) | trust | `@fabricstack/trust` | — | `TRUST_` (unchanged — already neutral) | `packages/trust` |\n| 42 | `@a5c-ai/kradle` (`packages/kradle/core`) — bins `kradle-demo`,`kradle-server` | control plane | `@fabricstack/control-plane` | `control-plane-server`, `control-plane-demo` | `CONTROL_PLANE_` | `packages/control-plane/core` |\n| 43 | `@a5c-ai/kradle-installer` (`packages/kradle/installer`) — bin `kradle-install` | **operator** (cluster install/upgrade control, per D18's example vocabulary; Helm+Terraform renderer, R3 §1.4) | `@fabricstack/operator` | `operator` | `CONTROL_PLANE_` | `packages/control-plane/operator` |\n\nGrouping note: rows 4–18 and 20–33 form the **harness family** (`harness-*` under `packages/harness/`), rows 34–37 the **agent-runtime family**, rows 38–39 (+incoming console apps, §3.3) the **console family**, rows 42–43 (+private siblings) the **control-plane family** — the grouping matches the four D2 surfaces and keeps the landed umbrella structure of `directory-moves.md` (its moves are already executed at HEAD; only the umbrella word changes).\n\n### 3.2 Private (non-publishable) workspaces\n\n| Current (dir) | New name | New directory | Disposition note |\n|---|---|---|---|\n| `@a5c-ai/kip-sdk` (`packages/kip-sdk`) | `@fabricstack/memory` | `packages/memory` | env `MEMORY_` (386 `KIP_*` occurrences counted at HEAD, §3.4 method); stays private; memory-ADR interaction is F-09 |\n| `@a5c-ai/kradle-sdk` (`packages/kradle/sdk`) | `@fabricstack/control-plane-sdk` | `packages/control-plane/sdk` | zero tests today (R1 §4.4) — rename does not launder that; Q-02 owns floors |\n| `@a5c-ai/kradle-cli` (`packages/kradle/cli`) | `@fabricstack/control-plane-cli` | `packages/control-plane/cli` | |\n| `@a5c-ai/kradle-web` (`packages/kradle/web`) | `@fabricstack/admin-console` | `packages/control-plane/web` | survives as the org-admin surface (synthesis §1.3) |\n| `@a5c-ai/kradle-jitsi-agent-sidecar` (`packages/kradle/jitsi-agent-sidecar`) | `@fabricstack/meeting-sidecar` | `packages/control-plane/meeting-sidecar` | \"jitsi\" is a third-party product name; dropped from the package name, kept in internals until RN-4 |\n| `@a5c-ai/atlas-webui` (`packages/atlas/webui`) | `@fabricstack/catalog-webui` | `packages/catalog/webui` | wildcard dep `\"@a5c-ai/atlas\": \"*\"` (`packages/atlas/webui/package.json:16`) is fixed by P-02/HYG2, not here |\n| `@a5c-ai/genty-tui-plugins` (`packages/genty/tui-plugins`) | `@fabricstack/console-tui-plugins` | `packages/console/tui-plugins` | |\n| `a5c-commander` (`apps/commander`; unscoped private manifest name — the one workspace not under `@a5c-ai/*`, `apps/commander/package.json:2-3`; 51 tests, mock-only backend, R1 §3.9) | `@fabricstack/ops-console` | `apps/ops-console` | rename rides RN-3; live-wiring-vs-descope is F-17 and does not block the rename |\n| `@a5c-ai/genty-web-app`, `@a5c-ai/genty-desktop-app`, `@a5c-ai/genty-{mobile-android,mobile-ios,tv-androidtv,tv-appletv,watch-watchos,watch-wearos}-app` | **no new names assigned — retired, not renamed** | deleted by T-27 | D2c retires these shells (L0, ~0 tests, R1 §3.3); renaming a unit scheduled for deletion is wasted motion. If T-27 slips past RN-3, the survivors get `console-web-legacy`/`console-*-shell` names in a Gate-B-noted amendment — until then they keep old names in place and are excluded from the rename tooling's completeness check by an explicit retirement list |\n\n`library/` (process library, in-repo but non-workspace, R1 §3.4) → `process-library/` (D18's example name), phase RN-3. `blueprints/` and `plugins/` follow `docs/blueprints-rename/README.md` (§5, WP-RN-11) — that rename is partially landed (a top-level `blueprints/` tree already exists, R1 §1).\n\n### 3.3 t3code-incoming units (D21 — land DIRECTLY under new names; no double rename)\n\nMigrated units from spec 10 never carry an `@a5c-ai/*` name or an old-style directory, even for a day. Spec 10's WPs must reference these names:\n\n| Migration unit (spec 10 WP) | New npm package | Directory | Bin |\n|---|---|---|---|\n| contracts tracked fork (T-02) | `@fabricstack/contracts` | `packages/contracts` | — |\n| effect-acp tracked fork (T-03) | `@fabricstack/acp` | `packages/acp` | — |\n| effect-codex-app-server fork (T-04) | `@fabricstack/codex-protocol` | `packages/codex-protocol` | — |\n| ssh extraction (T-28) | `@fabricstack/ssh` | `packages/ssh` | — |\n| tailscale extraction (T-29) | `@fabricstack/tailscale` | `packages/tailscale` | — |\n| environment server hard fork (T-19) | `@fabricstack/environment` | `apps/environment` | `environment-server` |\n| client-runtime hard fork (T-24) | `@fabricstack/client-runtime` | `packages/client-runtime` | — |\n| web app hard fork (T-25) | `@fabricstack/console-web` (private) | `apps/console-web` | — |\n| desktop app hard fork (T-26) | `@fabricstack/console-desktop` (private) | `apps/console-desktop` | — |\n| relay hard fork (T-31) | `@fabricstack/relay` (private) | `infra/relay` | — |\n\n### 3.4 Env-var prefix families (phase RN-2 surface; decision table)\n\nCounted at fabric HEAD `5e46b998e` over **git-tracked files under `packages/ apps/ scripts/`** (git grep only sees tracked files, so `node_modules/`, `dist/` and other build output are excluded by construction). \"Occurrences\" = total token matches; \"unique\" = distinct matched variable names. Reproduce with, per `<PREFIX>` (run at repo root):\n\n```\ngit grep -ohE '\\b<PREFIX>_[A-Z0-9_]*[A-Z0-9]' -- packages apps scripts | wc -l              # occurrences\ngit grep -ohE '\\b<PREFIX>_[A-Z0-9_]*[A-Z0-9]' -- packages apps scripts | sort -u | wc -l    # unique names\n```\n\nThese are **sizing figures**, not the rename inventory: the token pattern also matches same-shaped code constants and doc mentions, all of which the rename sweeps anyway. Completeness is gated by WP-RN-09 AC1's zero-hit grep, not by these counts.\n\n| Current prefix | Occurrences (unique names) | Target prefix | Rule |\n|---|---|---|---|\n| `ADAPTER_*` / `ADAPTERS_*` | 93 + 32 = 125 (19 + 17) | `AGENT_MUX_*` | **Adopt `env-var-renames.md` verbatim** (its full variable table incl. CI/action.yml sweep). `AGENT_MUX_*` is already the majority convention (422 landed occurrences at HEAD by the same count, e.g. `AGENT_MUX_PROXY_ATTESTATION_ENABLED`, `packages/adapters/transport/src/config.ts:47`) and is already neutral — renaming it again would be a forbidden double rename |\n| `BABYSITTER_*` | 663 (60) | `ORCHESTRATOR_*` | e.g. `BABYSITTER_ALLOW_SECRET_LOGS` → `ORCHESTRATOR_ALLOW_SECRET_LOGS` (`packages/babysitter-sdk/src/cli/main/taskCommands.ts:365`); `BABYSITTER_PLUGIN_*` → `ORCHESTRATOR_BLUEPRINT_*` (folds in `docs/blueprints-rename/README.md` \"Configuration\" table) |\n| `KRADLE_*` | 1193 (141) | `CONTROL_PLANE_*` | largest family; includes chart values/templates (also touched by RN-5) |\n| `GENTY_*` | 67 (10) | `AGENT_RUNTIME_*` | |\n| `ATLAS_*` | 133 (29) | `CATALOG_*` | |\n| `KIP_*` | 386 (32) | `MEMORY_*` | |\n| `A5C_*` (incl. `A5C_CLOUD_*` CI repo variables, `publish.yml:1285-1357`) | 35 (18) | `FABRIC_*` | platform-wide/CI family; `.github/` workflow bodies add ~49 more occurrences outside the counted file set — WP-RN-09's affected-paths sweep covers them |\n| Already neutral: `TRUST_*`, `AGENT_SESSION_ID`, `POLICY_CONFIG_ROOT_FP`, `CLAUDE_PLUGIN_ROOT`/`PI_PLUGIN_ROOT` (third-party surface, `docs/blueprints-rename/README.md` \"What Does NOT Change\") | — | unchanged | no double rename of neutral names |\n\nNo dual-read compatibility shims: the old-and-new-env fallback pattern proposed in `env-var-renames.md` (\"read both, prefer new\") targeted a public in-place migration; under D17/D10 the private train breaks cleanly in one release, and only the **public-facing plugin surfaces that run inside third-party harnesses** (hook adapters installed into user machines from the public repo) keep whatever the public repo ships — which this effort does not touch.\n\n### 3.5 Runtime data directories (phase RN-3 surface)\n\n| Current | Target |\n|---|---|\n| project `.a5c/` (runs, processes — journal store read by kanban, `packages/adapters/gateway/src/kanban/lib/source-discovery.ts:12-34`) | `.fabric/` |\n| user `~/.a5c/` (blueprints, profiles) | `~/.fabric/` |\n| `plugins/a5c/marketplace/` → `blueprints/a5c/marketplace/` | per `docs/blueprints-rename/README.md` (partially landed) |\n\nA one-shot `orchestrator migrate-data-dir` command moves existing `.a5c/` state; no dual-path reading is retained after it runs (D10).\n\n### 3.6 Chart / CRD / K8s names (phase RN-5 surface)\n\n| Current | Target | Evidence |\n|---|---|---|\n| Helm chart `kradle`, `version: 0.1.0` | chart `control-plane`, versioned with the platform (P-09 owns re-versioning) | `packages/kradle/charts/Chart.yaml:1-7` (R3 §1.2) |\n| CRD group `kradle.a5c.ai` (8 CRD files: agent/aggregated/artifact/external/inference/jitsi/policy/repositories) | `control-plane.fabric.internal` — a non-routable `.internal` group avoids minting a public DNS commitment for a private product | `packages/kradle/charts/crds/*.yaml` (`group: kradle.a5c.ai` in all 8) |\n| namespaces `kradle-system`, org-namespace prefixes, Helm release `kradle` | `control-plane-system`, matching prefix scheme, release `control-plane` | `packages/kradle/charts/README.md:30-56`, `publish.yml:852-877` |\n\nCRD group renames are the most invasive rename in the program (stored CRs must be migrated cluster-side; API group changes are breaking for every client) — hence last phase, with an explicit CR migration job (WP-RN-12).\n\n---\n\n## 4. Private distribution: GCP Artifact Registry npm (D19)\n\n### 4.1 Registry provisioning\n\n- **Where**: the existing GCP project `boot-464019`, region `us-central1` — the same project/region already hosting the Docker Artifact Registry used by the GKE pipeline (`us-central1-docker.pkg.dev`, `.github/workflows/publish.yml:3-6,880-893`; R3 §1.3). New npm-format repository `fabric-npm`; registry URL `https://us-central1-npm.pkg.dev/boot-464019/fabric-npm/`.\n- **Auth**: CI reuses the existing Workload Identity Federation step (`google-github-actions/auth@v2`, already wired in `deploy_kradle`, R3 §1.3) with the CI service account granted `roles/artifactregistry.writer` on `fabric-npm`; publish steps mint a short-lived access token (`gcloud auth print-access-token`) injected as `//us-central1-npm.pkg.dev/boot-464019/fabric-npm/:_authToken=${TOKEN}` via environment — never written to a committed file. Developers use `gcloud` ADC plus the `google-artifactregistry-auth` npm helper to refresh tokens into their user-level `~/.npmrc`; humans get `roles/artifactregistry.reader` by default, writer only for release owners.\n- **Committed root `.npmrc`** (scope routing only, no credentials):\n  - `@fabricstack:registry=https://us-central1-npm.pkg.dev/boot-464019/fabric-npm/`\n  - `//us-central1-npm.pkg.dev/boot-464019/fabric-npm/:always-auth=true`\n- **Dist-tag/channel scheme carries over unchanged**: `main→latest`, `staging→staging`, `develop→develop` with commit-pinned prereleases and the single resolver (`scripts/lib/release-version.cjs:44-46,146-151`; R3 §1.1) — Artifact Registry npm repos support dist-tags, so the resolver logic ports as-is (WP-RN-07).\n\n### 4.2 Publish pipeline relocation\n\nBecause npm publishing today lives **only** in the public repo (`publish.yml:3-6`), the private train needs its own publish workflow in fabric: the tag/recovery/verifier trio already present in this tree (`release-tags.yml`, `publish-packages-from-tag.yml`, `release-artifact-verifier.yml`; R3 §1.1) is retargeted at the AR registry and the renamed 43-package matrix, with tags `fabric/<branch>/v<version>` (§1.3). The public repo's pipeline is not modified (invariant §1.2.1). This also settles P-13's artifact-home question for npm bytes: private npm artifacts live in AR under `boot-464019`; spec 40 inherits that decision.\n\n### 4.3 Publish-isolation guards (binding; intent acceptance criterion 7)\n\n| Guard | Mechanism |\n|---|---|\n| **G1 — manifest-level pinning** | Every `@fabricstack/*` package.json sets `publishConfig.registry` to the AR URL. `npm publish` honors `publishConfig.registry` over any ambient config, so even a manual publish from a package dir cannot reach npmjs. The inventory selector must change in the same commit: `scripts/lib/publishable-packages.cjs:136-137` currently keys on `manifest.private !== true && manifest.publishConfig.access === \"public\"` — under the new scheme it keys on `publishConfig.registry` equaling the AR URL (otherwise the release train would see zero packages) |\n| **G2 — CI enforcement job** | A required check on every PR asserting: (a) no workspace package.json under scope `@fabricstack` lacks the exact AR `publishConfig.registry`; (b) no package.json anywhere in fabric carries an `@a5c-ai/*` `name` after RN-1 cutover (retirement-listed shells excepted until T-27); (c) no workflow file contains `registry.npmjs.org` in a publish context; (d) `verify-manifests` (`scripts/release-version.cjs:24-27`) extended to fail on any internal dep referencing `@a5c-ai/*` |\n| **G3 — credential starvation** | Fabric's repo secrets contain **no npmjs token** — today they already don't (npm publishing is \"deliberately absent here\", `publish.yml:3-6`); the guard is a documented invariant plus a CI assertion that no workflow references an `NPM_TOKEN`-style secret against npmjs. Without credentials, an accidental public publish fails even if G1/G2 were both bypassed |\n| **G4 — defensive scope registration** | Create the `fabricstack` org on public npmjs, publish **nothing**, enable 2FA and restrict membership — this prevents third-party scope-squatting that would otherwise let a typo'd `npm publish --registry https://registry.npmjs.org` semi-succeed for an attacker-claimed scope. Publishing there remains forbidden (D19); the org exists purely as a tombstone |\n| **G5 — bin-collision gate** | The existing \"Binary rename guardrail\" CI step (`.github/workflows/ci.yml:99-102`, `npm run test:binary-renames`) is extended to assert the single-bin policy of §3: the union of all `bin` keys across the 43 packages must be collision-free and exactly match the §3.1 bin column — permanently retiring the `babysitter`/`adapters`/`adapters-hooks` duplicate-bin class (R3 §1.6) |\n| **G6 — packed-artifact scope check** | The FIX-011 packed-artifact verifier (`.github/workflows/release-artifact-verifier.yml:1-16`) gains one assertion per tarball: unpacked `package.json` name starts with `@fabricstack/` and `publishConfig.registry` is the AR URL — so nothing mis-scoped can pass the release gate even if it slipped through PR CI |\n\n---\n\n## 5. Phasing (D20) and interaction rules with the t3code migration (D21)\n\nPhase order is fixed by D20: **packages + binaries first; env vars, directories, code identifiers, chart/CRD names in later phases.**\n\n| Phase | Surface | Work packages | Gate |\n|---|---|---|---|\n| RN-0 (immediately, before everything) | Hard split + registry + guards | WP-RN-01, 02, 03, 04 | split effective; AR live; guards red-until-green |\n| RN-1 | npm packages + binaries + release machinery | WP-RN-05, 06, 07 | first AR-published train under `@fabricstack/*` |\n| RN-2 | env vars | WP-RN-09 | zero `ADAPTER_/BABYSITTER_/KRADLE_/GENTY_/ATLAS_/KIP_/A5C_` refs |\n| RN-3 | directories + data dirs + process-library | WP-RN-10 | tree matches §3 directory column |\n| RN-4 | code identifiers + blueprints-rename completion | WP-RN-11 | identifier greps clean |\n| RN-5 | chart/CRD/K8s names | WP-RN-12 | renamed chart deployed to all three GKE envs |\n| RN-X (parallel to all) | docs/skills sweep + Gate-B name-lock record | WP-RN-08, 13 | — |\n\n**Interaction rules (binding on specs 10/20/30/40/50, per D21):**\n\n1. **No double rename.** Any unit migrated from t3code lands directly under its §3.3 name, scope, directory, and bin. A spec-10 WP that lands a unit under a t3code or `@a5c-ai` name violates this spec.\n2. **RN-0/RN-1 precede T-01.** Fork intake (T-01) requires the AR registry, guards, and the scope to exist, otherwise the first landed fork would need renaming later. T-02…T-33 depend transitively.\n3. **Later phases do not block migration.** Spec-10 work must not wait for RN-2…RN-5; migrated code may temporarily *reference* old env vars/dirs of not-yet-renamed fabric units, and RN-2/RN-3 sweeps include the migrated units in their rename scope.\n4. **Retired units are never renamed** (§3.2): T-27's retirement list is the single exemption list for all rename completeness checks.\n5. **Bulk upstream intake before RN-3** (§1.4): directory moves multiply cherry-pick friction; the intake owner is warned in the WP-RN-10 acceptance gate.\n6. **Spec 40 consistency**: packaging WPs (P-01 exports maps, P-07 npm launcher, P-09 chart, P-13 artifact home) operate on the renamed matrix and the AR registry; P-01's exports-map program and the D10 major bump land in the same train as RN-1 so publics are defined once, under the new names (R3 spec input 8).\n\n---\n\n## 6. Work packages\n\n### WP-RN-01: Execute the two-repo hard split\n- **Objective**: Fabric stops being a mirror of public `a5c-ai/babysitter`; divergence policy (§1.5) is documented in-repo; the public repo is untouched.\n- **Affected paths**: hosting-level mirror configuration (outside the tree); `.github/workflows/publish.yml:3-6` (header rewrite); new `docs/DIVERGENCE-POLICY.md`; `README.md` repo-role statement.\n- **Acceptance criteria**: (1) no automated public→private sync occurs after cutover, verified **strictly read-only** (invariant §1.2.1 stays absolute — this WP creates no branch, tag, commit, or any other ref on the public repo, not even a scratch one): (a) the hosting-level mirror transport is confirmed disabled, with the settings/API evidence captured in the WP closing note, **and** (b) passive propagation watch — at cutover, record the newest `upstream/main` commit SHA; over an observation window of ≥7 days that must contain at least one upstream commit post-dating cutover (extend the window until one exists — upstream is actively maintained), `git fetch upstream` plus a before/after `git for-each-ref` audit of fabric shows that no upstream commit entered any fabric ref except via an explicitly labeled `upstream-intake` PR (§1.4); (2) `publish.yml` no longer self-describes as a mirror; (3) divergence policy doc states invariants §1.2.1–4 verbatim; (4) zero commits to the public repo originate from this WP (its reflog/PR list audited).\n- **Test requirements**: CI check from WP-RN-02 (public-remote guard) green; docs-quality gate passes on the new policy doc.\n- **Dependencies**: none (first mover).\n- **Size**: S\n\n### WP-RN-02: Cherry-pick-only intake workflow and public-push guard\n- **Objective**: Codify the §1.4 intake process; make pushing fabric content to the public repo mechanically impossible from CI.\n- **Affected paths**: new `docs/UPSTREAM-INTAKE.md`; new CI job in `.github/workflows/ci.yml` (guard); repository branch-protection settings; PR label + template `upstream-intake`.\n- **Acceptance criteria**: (1) intake doc specifies remote setup (fetch-only `upstream`), PR labeling, path-map documentation and the conflict policy (fabric wins); (2) a CI guard fails any workflow/config referencing `a5c-ai/babysitter` as a push target or checkout-with-write; (3) a rehearsal cherry-pick of one real upstream commit lands via the documented flow with its path map recorded.\n- **Test requirements**: guard job has a self-test fixture (a deliberately-bad workflow snippet in a test asserting the guard trips); rehearsal PR merged and referenced.\n- **Dependencies**: WP-RN-01.\n- **Size**: S\n\n### WP-RN-03: Scope decision + Artifact Registry npm provisioning\n- **Objective**: `@fabricstack` scope adopted (§2, locked at Gate B); AR npm repo `fabric-npm` live in `boot-464019`/`us-central1` with WIF-based CI auth and documented developer auth.\n- **Affected paths**: GCP project `boot-464019` (new AR repo + IAM bindings); root `.npmrc` (new, scope routing only); `docs/user-guide/`… private-install doc (new page); CI auth steps in the fabric publish workflow (built in WP-RN-07).\n- **Acceptance criteria**: (1) `npm ping --registry https://us-central1-npm.pkg.dev/boot-464019/fabric-npm/` succeeds from CI via WIF token; (2) a throwaway `@fabricstack/smoke` package publishes to AR from CI and installs on a developer machine following only the written auth doc; (3) committed `.npmrc` contains scope routing and zero credentials; (4) IAM: CI SA writer, humans reader-by-default (binding list reviewed).\n- **Test requirements**: publish/install smoke automated as a workflow-dispatch job; secret-scan on `.npmrc` history.\n- **Dependencies**: WP-RN-01 (fabric owns its own pipeline identity).\n- **Size**: M\n\n### WP-RN-04: Publish-isolation guards G1–G6\n- **Objective**: Renamed packages can never publish to public npmjs (D19); bin collisions can never recur.\n- **Affected paths**: `scripts/lib/publishable-packages.cjs:136-137` (selection criterion change); `scripts/release-version.cjs:24-27` (verify-manifests extension); new CI job in `ci.yml`; `.github/workflows/release-artifact-verifier.yml` (G6 assertion); `ci.yml:99-102` binary-rename guardrail extension (G5); npmjs org `fabricstack` (G4, external).\n- **Acceptance criteria**: (1)–(6) = guards G1–G6 of §4.3 each implemented and red-until-green demonstrated: a fixture package with `publishConfig.access: \"public\"`+npmjs registry must fail G1/G2; a fixture duplicate bin must fail G5; a mis-scoped tarball must fail G6; (7) repo secret audit shows no npmjs credential (G3) recorded in the WP's closing note.\n- **Test requirements**: each guard ships with a negative-fixture test in the guard job itself; `test:binary-renames` extended suite green.\n- **Dependencies**: WP-RN-03 (registry URL exists to pin).\n- **Size**: M\n\n### WP-RN-05: Phase-1 package renames — the full §3.1/§3.2 matrix\n- **Objective**: All 43 publishables and the 8 renamable private workspaces carry their `@fabricstack/*` names; every internal dependency edge updated; retirement-listed shells excluded per §3.2.\n- **Affected paths**: every `package.json` named in §3.1/§3.2 (`name`, `publishConfig`, internal `dependencies`); root `package.json` workspaces (unchanged globs — dirs move only in RN-3); `package-lock.json` regeneration; source import specifiers of workspace packages (`@a5c-ai/…` → `@fabricstack/…`) across `packages/ apps/ scripts/ library/`.\n- **Acceptance criteria**: (1) `publishable-packages.cjs` prints exactly 43 `@fabricstack/*` entries; (2) repo-wide grep for `@a5c-ai/` in package manifests and source import statements returns only the retirement list and historical docs; (3) full workspace build + `test:sdk` + architecture gate pass (`ci.yml:114-132`); (4) `verify-manifests` passes with the G2(d) extension active.\n- **Test requirements**: all PR-gating CI jobs (`ci.yml` jobs at :15,:54,:319,:372,:459 — R1 §4.1) green on the rename commit; packed-artifact verifier dry-run over the renamed matrix.\n- **Dependencies**: WP-RN-03, WP-RN-04.\n- **Size**: L\n\n### WP-RN-06: Phase-1 binary renames + bin-collision resolution\n- **Objective**: Every package ships exactly the §3.1 bin column under the single-bin policy; the `babysitter` bin collision and the `adapters`/`adapters-hooks` duplicate-bin collisions are permanently resolved.\n- **Affected paths**: `bin` maps in `packages/babysitter/package.json:7-9`, `packages/babysitter-sdk/package.json:9-14`, and the 13 other bin-bearing manifests enumerated in §3.1; the bin entry scripts they point at; docs referencing old bin names.\n- **Acceptance criteria**: (1) union of all bin keys across publishables is duplicate-free and equals the §3.1 bin set exactly; (2) `npm i -g` of `@fabricstack/orchestrator` + `@fabricstack/harness-cli` from AR on a clean machine installs without EEXIST bin conflicts; (3) each renamed bin passes a `--version`/`--help` smoke.\n- **Test requirements**: extended `test:binary-renames` (G5) green; release-artifact-verifier bin smoke tests (`release-artifact-verifier.yml:5-9`) pass over renamed bins.\n- **Dependencies**: WP-RN-05 (same train).\n- **Size**: M\n\n### WP-RN-07: Release machinery retarget (versions, tags, waves, verifier → AR)\n- **Objective**: The incident-hardened release train (resolver, immutable tags, waves, packed-artifact gate, recovery publish — R3 §1.1) publishes the renamed matrix to Artifact Registry under `fabric/<branch>/v<version>` tags, keeping channel semantics `main→latest / staging→staging / develop→develop`.\n- **Affected paths**: `scripts/release-version.cjs` + `scripts/lib/release-version.cjs:44-46,146-151` (registry + tag-prefix parameters); `scripts/release-matrix.cjs`; `.github/workflows/release-tags.yml`, `publish-packages-from-tag.yml`, `release-artifact-verifier.yml`, `fix-npm-tags.yml`; a new `publish-npm-private.yml` in fabric (§4.2).\n- **Acceptance criteria**: (1) an end-to-end staging release publishes all 43 renamed packages to AR in dependency waves, moves the `staging` dist-tag, and creates one `fabric/staging/v…` tag; (2) `release-version.cjs verify` passes against AR; (3) recovery path `publish-packages-from-tag.yml` proven by a rehearsal from-tag publish under a candidate dist-tag; (4) the public repo's tag namespace shows no new tags from this train.\n- **Test requirements**: published-consumer validation job (per `publish-packages-from-tag.yml:20-27` pattern) runs against AR: fresh project, `.npmrc` scope routing, install + import + bin smoke of `@fabricstack/orchestrator-sdk`.\n- **Dependencies**: WP-RN-04, WP-RN-05, WP-RN-06.\n- **Size**: L\n\n### WP-RN-08: t3code intake naming rules — no-double-rename gate\n- **Objective**: Spec 10's migrated units land only under §3.3 names; a mechanical gate enforces it for the life of the migration.\n- **Affected paths**: `docs/specs/platform-gaps/10-t3code-migration.md` (consumes §3.3 as its naming source of truth); the WP-RN-04 CI guard job (extra assertion: no package.json `name` matching `@t3code/*`, `t3-*`, or `@a5c-ai/*` for new units); intake PR template.\n- **Acceptance criteria**: (1) spec 10's final text references `@fabricstack/{contracts,acp,codex-protocol,ssh,tailscale,environment,client-runtime,console-web,console-desktop,relay}` and no interim names (Gate-B cross-check); (2) the CI assertion trips on a fixture `@t3code/x` manifest; (3) the first real landed fork (T-01/T-02 output) passes the gate un-waived.\n- **Test requirements**: negative fixture in the guard job; Gate-B compliance matrix row (R-03) cites this WP.\n- **Dependencies**: WP-RN-04; blocks T-01.\n- **Size**: S\n\n### WP-RN-09: Phase-2 env-var renames\n- **Objective**: The §3.4 prefix table is fully applied: `ADAPTER_*`→`AGENT_MUX_*` per `env-var-renames.md` (adopted verbatim, incl. its workflow/action.yml/pipeline-template sweep), `BABYSITTER_*`→`ORCHESTRATOR_*` (663 occurrences, §3.4 count), `KRADLE_*`→`CONTROL_PLANE_*` (1193), `GENTY_*`→`AGENT_RUNTIME_*` (67), `ATLAS_*`→`CATALOG_*` (133), `KIP_*`→`MEMORY_*` (386), `A5C_*`→`FABRIC_*` (35 in the counted set + `.github/` workflow bodies); no dual-read shims retained.\n- **Affected paths**: all source/config/workflow files carrying the counted prefixes (source sweep across `packages/ apps/ scripts/`); `.github/workflows/*.yml` env blocks; `packages/adapters/triggers` pipeline templates (per `env-var-renames.md` CI/CD section); GKE Secret Manager prefixes and repo variables (`A5C_CLOUD_*`, `publish.yml:1285-1357`) coordinated with the ops owner.\n- **Acceptance criteria**: (1) repo-wide grep for `\\b(ADAPTER|ADAPTERS|BABYSITTER|KRADLE|GENTY|ATLAS|KIP|A5C)_[A-Z]` in source/workflows returns zero hits outside historical docs and the T-27 retirement list; (2) live-stack matrix (R1 §4.3) green post-rename — it is the strongest env-sensitive suite; (3) deployed staging environment comes up with renamed Secret Manager prefixes.\n- **Test requirements**: full PR CI + `live-stack.yml` push-default lanes + kradle deployed-stack e2e (`publish.yml:423-424`) green on the rename commit.\n- **Dependencies**: WP-RN-05 (names exist), WP-RN-07 (train can ship it); does not block spec-10 WPs (interaction rule 3).\n- **Size**: L\n\n### WP-RN-10: Phase-3 directory moves + data-dir migration\n- **Objective**: The tree matches the §3.1/§3.2 directory column (`packages/{orchestrator,harness,agent-runtime,console,control-plane,catalog,trust,memory,observer,model-gateway}`, `apps/ops-console`, `process-library/`); runtime data dirs move `.a5c/`→`.fabric/`, `~/.a5c/`→`~/.fabric/` with a one-shot migration command; the landed structure of `directory-moves.md` is preserved under the new umbrella words.\n- **Affected paths**: `git mv` of every directory in the matrix; root `package.json` workspaces globs; `tsconfig` references; import paths; `.github/workflows/*.yml` build paths; `packages/atlas/graph/` source refs (all five reference classes enumerated in `directory-moves.md` Phase 3); kanban run discovery (`packages/adapters/gateway/src/kanban/lib/source-discovery.ts:12-34`) and every `.a5c/` literal; new `orchestrator migrate-data-dir` command in the orchestrator SDK CLI.\n- **Acceptance criteria**: (1) zero directories named for old components remain under `packages/`/`apps/` except the T-27 retirement list; (2) full build + all PR CI jobs green; (3) `migrate-data-dir` moves a populated `.a5c/` fixture (runs + journal) and a subsequent run replays from `.fabric/` byte-identically (journal checksums compared); (4) bulk-intake warning: WP owner confirms in the closing note that the intake owner (§1.4) signed off before execution.\n- **Test requirements**: journal replay integration test over migrated fixture; kanban source-discovery unit tests updated and green; live-stack smoke on one harness lane.\n- **Dependencies**: WP-RN-05, WP-RN-09.\n- **Size**: L\n\n### WP-RN-11: Phase-4 code-identifier renames + blueprints-rename completion\n- **Objective**: Apply `code-identifier-renames.md` (3,500+ `adapter*`→`agentMux*` identifier refs, file renames in the agent-platform harness layer, mobile namespace items reduced to whatever survives T-27) and complete `docs/blueprints-rename/README.md` (SDK `src/plugins/`→`src/blueprints/`, remaining CLI/docs/skill references; marketplace dir move if not yet landed) — both absorbed as written, with targets re-spelled to §3 names where those docs predate D18 (e.g. their `agentMux*` camelCase family is kept: it is neutral and matches the adopted `AGENT_MUX_*` env family, so re-deriving a new casing would be a double rename).\n- **Affected paths**: per `code-identifier-renames.md` tables (`packages/genty/platform/src/harness/adapters/*` → renamed under `packages/agent-runtime/platform/...` post-RN-10); `packages/babysitter-sdk/src/plugins/` (post-RN-10: `packages/orchestrator/sdk/src/blueprints/`); test files/mocks/fixtures listed in both docs.\n- **Acceptance criteria**: (1) identifier greps from `code-identifier-renames.md` §\"Source Code Identifiers\" return zero old-pattern hits; (2) blueprint CLI surface is `orchestrator blueprints:*` with no plugin-named alias; (3) all touched packages' suites green; (4) no behavior change: the rename commits contain no logic edits (reviewed as mechanical).\n- **Test requirements**: full PR CI; genty(-platform→agent-runtime-platform) 135-test package green (R1 §3.3); blueprint install/list e2e against a fixture marketplace.\n- **Dependencies**: WP-RN-10.\n- **Size**: L\n\n### WP-RN-12: Phase-5 chart / CRD / K8s renames\n- **Objective**: Chart `kradle`→`control-plane`; CRD group `kradle.a5c.ai`→`control-plane.fabric.internal` across all 8 CRD files with a stored-CR migration; namespaces/release names per §3.6; deployed to all three GKE environments.\n- **Affected paths**: `packages/kradle/charts/` (post-RN-10: `packages/control-plane/core/charts/` or the chart's P-09 home) — `Chart.yaml:1-7`, all `crds/*.yaml`, 23 templates, `values.yaml`; `publish.yml:852-877,952-955,1080` (helm/namespace/CRD-apply steps); kradle-core reconcilers' group/kind references (`packages/kradle/core/src/*.js` CR clients); a CR migration job (export old-group CRs → transform → apply new group → verify → delete old CRDs).\n- **Acceptance criteria**: (1) `helm upgrade --install control-plane …` deploys cleanly to develop, staging, then prod, in that order; (2) CR migration rehearsed on develop with zero orphaned old-group CRs after cutover (audited via `kubectl get crd | grep kradle.a5c.ai` = empty); (3) reconcile loop adopts migrated CRs (regression guard for the HEAD-commit bug class: \"repository reconcile loop must only adopt its own environment's CRs\", HEAD `5e46b998e` message); (4) e2e smoke (`publish.yml:1131`) green in each environment post-cutover.\n- **Test requirements**: kradle-core node:test suite (`publish.yml:565-568`) updated and green; deployed-stack e2e + smoke (`publish.yml:423-424`); chart render golden tests for renamed values keys.\n- **Dependencies**: WP-RN-09, WP-RN-10; coordinates with P-09 (chart productization) so re-versioning and renaming land as one chart-consumer break, not two.\n- **Size**: L\n\n### WP-RN-13: Docs/skills surface sweep + Gate-B name-lock record\n- **Objective**: All in-repo docs, docs-site pages, skills, process-library references and install guides speak the §3 names; the locked matrix is recorded as the program's naming decision record.\n- **Affected paths**: `docs/` and `docs-site/` (incl. `docs/user-guide/getting-started/installation.md:126-131` rewritten for the private AR install path); `library/` (→`process-library/`) skill/process texts; `MATURITY-MATRIX.md` row names; a new `docs/NAMING-DECISION-RECORD.md` embedding §2+§3 verbatim with Gate-B approval reference; deprecation banner notes in `docs/adapters/terminology-and-structure-gaps/README.md` and `docs/blueprints-rename/README.md` marking them absorbed-by-this-spec.\n- **Acceptance criteria**: (1) docs-quality CI gate green; (2) grep of `docs/ docs-site/` for old package/bin names returns only historical/changelog contexts and the absorbed planning docs' own tables; (3) the decision record exists and matches Gate-B-approved §3 byte-for-byte; (4) both absorbed planning-doc trees carry a pointer banner to this spec.\n- **Test requirements**: docs QA scripts (`package.json:116-123` docs gates, R3 §1.6) green; link-check over renamed doc paths.\n- **Dependencies**: WP-RN-05 (names final); updated incrementally as RN-2…RN-5 land.\n- **Size**: M\n\n---\n\n## 7. Consistency obligations on the other specs (D21 checklist for Gate B)\n\n| Spec | Obligation |\n|---|---|\n| `10-t3code-migration.md` | Units land under §3.3 names (WP-RN-08 gate); T-01 depends on WP-RN-03/04/08; no WP touches the public repo |\n| `20-functionality-coverage.md` | F-* WPs cite current names until RN-1 merges, thereafter §3 names; F-17 (ops-console disposition) and F-09 (memory ADR) reference the renamed units |\n| `30-testing.md` | Q-01/Q-02 floors attach to renamed packages; Q-04 whole-platform e2e installs from **Artifact Registry**, not npmjs |\n| `40-packaging.md` | P-01 exports maps land with RN-1 in one major bump (D10); P-07 npm launcher publishes to AR; P-09/P-13 inherit §3.6 and §4.2 artifact-home decisions; no packaging WP creates a public-npm channel for `@fabricstack/*` |\n| `50-roadmap-workpackages.md` | R-01 sequences RN-0/RN-1 ahead of T-01; R-03 traces D17–D21 against this spec verbatim |\n\nWork-package count in this spec: **13** (WP-RN-01 … WP-RN-13).\n",
    "documents": []
  },
  "outgoingEdges": [],
  "incomingEdges": [
    {
      "from": "page:docs",
      "to": "page:docs-specs-platform-gaps-15-private-isolation-rename",
      "kind": "contains_page"
    }
  ]
}