Claim
After scheduler-owned executable-operation Actions have replaced every direct singleton convergence witness, TrustedRuntimeHost::prepare_echo_operation_v1(...) and TrustedRuntimeHost::commit_prepared_echo_operation_v1(...) should no longer be public downstream Rust seams. Private bounded evaluation remains scheduler-internal Tick-construction evidence.
Current posture
ADR 0025 and issue #687 explicitly permit these methods as transitional compatibility/test seams. They remain pub and #[doc(hidden)] because the executable-operation compatibility suite still exercises the original singleton corridor. TrustedRuntimeApp does not expose them, but Rust visibility alone does not prevent a downstream host owner from calling them.
Acceptance
- Migrate or retire every direct singleton witness that still requires the public methods.
- Make direct preparation and prepared commit crate-private, test-only, or remove them.
- Keep scheduler-owned Action evaluation and Tick construction unchanged.
- Preserve canonical package, program, invocation, result, and receipt compatibility where still promised.
- Update ADR 0023 and ADR 0025 to remove the transitional exception.
- Prove downstream application code cannot compile against a direct prepare/commit lifecycle.
Non-goals
- Reintroducing callbacks, provider-v1 expansion, or application-owned evaluation.
- Removing the private evaluator used by scheduler Tick construction.
- Edict compiler or Graft application work.
Claim
After scheduler-owned executable-operation Actions have replaced every direct singleton convergence witness,
TrustedRuntimeHost::prepare_echo_operation_v1(...)andTrustedRuntimeHost::commit_prepared_echo_operation_v1(...)should no longer be public downstream Rust seams. Private bounded evaluation remains scheduler-internal Tick-construction evidence.Current posture
ADR 0025 and issue #687 explicitly permit these methods as transitional compatibility/test seams. They remain
puband#[doc(hidden)]because the executable-operation compatibility suite still exercises the original singleton corridor.TrustedRuntimeAppdoes not expose them, but Rust visibility alone does not prevent a downstream host owner from calling them.Acceptance
Non-goals