yoi/docs/report/2026-09-22-repository-local-yoi-final-authority-audit.md

# T-452 final repository-local `.yoi` authority audit

Date: 2026-09-22
Objective: O-12
Ticket: T-452

## Baseline and method

The implementation branch was created from `develop` at `043cb7bf22bd59d1d553e3f5a7c86c20502fad30` after confirming that ref was the then-current provider-resolved `origin/develop`, then refreshed by a normal merge from final T-629-integrated `develop` at `a6890727560af09a1b6a2e46c021fa4d6d26f8bd` before publication and review. This audit follows normal entrypoints through constructors and typed backends to their I/O boundary. A raw `.yoi` string search was used only to enumerate candidates; strings in comments, negative regression fixtures, explicit artifacts, and preserved storage boundaries are not treated as authority by themselves.

T-629 owns conversion of the panel E2E setup to the Backend-owned dashboard fixture. The integrated fixture is preserved unchanged by T-452 and is included in the final non-interference/no-write validation; no legacy `yoi ticket init` setup was restored or duplicated.

## Reachability and disposition

| Surface | Entry point and pre-change path | Disposition |
| --- | --- | --- |
| Ticket config | `TicketConfig::load_workspace` read `<workspace>/.yoi/workspace.toml`, fell back to `.yoi/ticket.config.toml`, and defaulted to `.yoi/tickets`. | Removed the filesystem loader, backend path/provider types, fallback parser, and path resolution. `ticket::config` now contains only filesystem-independent fixed-role domain types. |
| Ticket provider | Public `LocalTicketBackend` performed Ticket tree reads/writes. `SqliteTicketBackend::import_from_local_backend` converted that tree into SQLite. | Removed both production providers/helpers and their filesystem-only tests. SQLite fixtures now seed `typed_tickets`/events directly. Deliberately stale Ticket/Objective trees remain only as ignored-input regressions. |
| Worker Ticket tools | `TicketFeatureBackend::Local`, `TicketFeature::for_workspace[_with_access]`, and local constructors could install filesystem-backed tools even though the normal controller already selected a Workspace client. | Removed the local variant and constructors. The feature now accepts only an injected `Arc<dyn WorkspaceClient>` and constructs `WorkspaceHttpTicketBackend`; there is no provider-selection enum or filesystem path parameter. |
| Memory CLI | `yoi memory lint` -> `memory_lint::run` -> cwd/`--workspace` -> `WorkspaceLayout` -> filesystem linter. | Removed the mode, parser/help branch, module, and CLI dependency. Old invocations fail as unknown before target/cwd resolution and do not read or mutate malformed legacy input. No replacement Memory UX or compatibility shim was added. |
| Memory provider | `WorkspaceLayout::resolve` searched cwd/ancestors and supplied `.yoi/memory` paths to query/resident, staging, consolidation, audit, usage, scope, and lint implementations. `execute_memory_backend_operation` dispatched operations to that layout. | Removed layout/discovery, local executor, resident/scope/usage writers, extraction/consolidation staging files, filesystem audit implementation, and path-scanning linter modules. Kept Backend operation DTOs, extraction payload/tool contracts, audit event DTOs, provenance/frontmatter schema helpers, and lint-common slug types because they are filesystem-independent shared domain/API types. Workspace Server SQLite authority remains the Memory persistence executor. |
| Runtime store | Public `WorkerRuntimeExecutionBackend::from_workspace` derived `<workspace>/.yoi/runtime-store`. | Removed. Runtime callers continue to pass explicit Runtime-owned store/config paths; no repository fallback was introduced. |
| Workspace/client/bootstrap | Normal `yoi init`, client target resolution, Workspace catalog/metadata, Server bootstrap, and repository mapping were already cut over by T-468. | Preserved. Existing root/ancestor stale-marker and clean-init tests continue to assert Server DB/API plus XDG client routing, with no repository write. |
| Profile/Skill/Prompt | Workspace projections were already sourced from the Server virtual config tree; direct Worker startup uses explicit manifest/builtin authority. | Preserved. Existing malformed local profile/prompt/skill fixtures are negative tests. A clean direct Worker-startup regression now verifies that manifest resolution does not create `.yoi`. |
| Plugin | T-603 already removed ambient `.yoi/plugins` discovery. | Preserved the source assertions and explicit `.yoi-plugin` offline package operations. No install/runtime fallback was added. |
| Objective | Worker Objective tools already require Workspace API authority; Workspace Server stores Objective rows in SQLite. | Preserved. Filesystem-only Objective fixtures are ignored-input regressions, not import setup. |
| Web/TUI | Both consume Workspace HTTP/client models and do not construct repository Ticket/Memory backends. | Preserved. Their checks validate the current typed API/routing surfaces; the integrated T-629 panel E2E uses the Backend-owned dashboard fixture and no repository-local Ticket setup. |

## Regression evidence added or strengthened

- Source assertions reject the concrete production provider/constructor chain rather than banning every `.yoi` string: Ticket config/provider/import, Worker local Ticket feature, Memory layout/executor/staging entrypoints (including every compiled extraction implementation module), Runtime `from_workspace`, and CLI `memory_lint` mode.
- `TicketFeature` has no repository/cwd input: installation accepts only an authority-scoped Workspace client and access policy. A regression verifies that separately present malformed repository-root Ticket input and malformed ancestor Workspace input remain byte-for-byte unchanged while the Workspace tool surface installs.
- The removed Memory CLI is unknown with bare, `lint`, help, and legacy `--workspace` forms; a malformed `.yoi/memory` fixture remains byte-for-byte unchanged.
- Direct Worker manifest resolution against a clean explicit workspace does not create `.yoi`. A Runtime integration regression additionally creates a Worker from a clean Git repository, executes a turn, stops/restores the Worker, and verifies that launch and restore never create repository-local `.yoi` authority.
- Ticket tool mutation uses a direct SQLite backend and asserts `tickets.db` is written while `.yoi`/`tickets` are not.
- Workspace Server authority seeds SQLite Ticket/Objectives directly, proves filesystem-only records are ignored, and proves legacy Memory staging cannot enter the Backend consolidation backlog.

## Final-source validation

The final candidate was validated after the normal merge of T-629-integrated `develop`. All commands below completed successfully:

| Boundary | Command and result |
| --- | --- |
| Normal compile closure | `cargo check` — passed. |
| Workspace/test targets | `cargo check --workspace --all-targets` — passed. |
| Changed Rust crates | `cargo test -p memory`; `cargo test -p ticket`; `cargo test -p worker --lib`; `cargo test -p worker-runtime`; `cargo test -p yoi --bin yoi`; `cargo test -p yoi-workspace-server`; `cargo test -p tui` — passed, including 16 Memory, 74 Ticket, 582 Worker, 100 CLI, 421 Server-library, and 270 TUI library tests. |
| Focused authority regressions | `cargo test` filters for `production_source_has_no_repository_local_memory_provider`, `production_source_has_no_repository_local_ticket_provider`, `production_source_has_no_local_ticket_feature_backend`, `workspace_only_ticket_feature_preserves_unrelated_stale_repository_trees`, `production_source_has_no_repository_derived_runtime_store`, `worker_spawn_receives_materialized_workspace_cwd_instead_of_source_repo`, `removed_memory_command_is_unknown_without_touching_legacy_trees`, and `sqlite_workspace_authority_reads_sqlite_records_without_filesystem_authority` — passed. |
| T-629 Backend panel baseline | `cargo test -p yoi-e2e --features e2e --test panel -- --test-threads=2` — passed, 2/2. The fixture contains no `yoi ticket init` invocation. |
| Rewind E2E | `cargo test -p yoi-e2e --features e2e --test rewind -- --test-threads=2` — passed, 1/1. |
| Web | `cd web/workspace && deno task check && deno task test && deno task build` — passed. The build emitted only existing unused-import/chunk-size warnings. |
| Formatting and patch integrity | `nix develop -c cargo fmt --all -- --check` and `git diff --check HEAD` — passed. The host toolchain does not directly provide `cargo fmt`, so the repository dev shell supplied the pinned rustfmt component. |
| Reachability inventory | Exact-symbol and path-join source scans found removed provider names only inside source assertions, negative fixtures, or comments. Remaining executable `.yoi` path construction is limited to the preserved home-directory boundary; repository paths occur only in ignored-input/no-write tests. |

## Remaining `.yoi` classifications

The post-change source inventory contains the following intentional classes:

1. **Negative regression input or assertions:** stale/malformed Workspace, Ticket, Objective, Memory, Profile, Skill, Prompt, and Plugin trees; assertions that clean operation creates no `.yoi`; leak-prevention fixtures.
2. **Preserved runtime/server boundaries:** Runtime-owned Workdirs and run artifacts, explicit Server data/config directories, session-store compatibility for the legacy home-directory secret/session boundary, and generated ignore files that prevent execution artifacts from entering Git.
3. **Explicit artifacts:** repository/Git files selected by the user and `.yoi-plugin` package paths passed directly to offline `new`/`check`/`pack` commands.
4. **Documentation/history:** current guidance describing removal and historical reports retained as historical evidence.

None of these classes performs cwd/ancestor authority discovery, automatic import, dual read, or repository-local fallback. The repository checkout and Git metadata remain ordinary filesystem inputs; removing filesystem use in general is outside T-452.

## Upgrade contract

There is no automatic migration, startup import, compatibility reader, or delete pass. Deployments that still need legacy repository-local Ticket or Memory data must export it with the old version before upgrading and import it through a supported Workspace-backed surface. Stale trees are ignored and can be archived or removed only after operator verification.