[smith-xyz]

Plan: plans/traust-standardization/0-continuous-ops/in-review/17-shaun-traust-core-only.md (part)

Wave 3 (traust-engine). Stacked on #112 (test/pack-fixture-loop-tests, lane (f)'s engine PR), with development (#111) merged in. Merge #112 first.

Chain: traust-core #225 / #223 / #222 / #229 → traust lanes a–e → traust#291 (lane f) → traust-engine #112 → this PR.

Scope (decided: keep what traust#291 still calls)

traust#291 keeps traust-engine as a dependency for three ops that wait on Shaun's retire-or-port decision. So this PR deletes everything else that moved to core and keeps exactly what those ops reach. traust can still re-pin to this commit. The final engine deletions and traust's dependency drop are one follow-up after Shaun's three decisions, which is why this keeps "(part)".

Kept for traust	Marker
sweep/ (ops, engine, benchmark, rule_lane, mining, calibration), corpus/resolver.py, adapters/opengrep.py, adapters/ops.py	PENDING(decision: sweep stages)
portfolio/ (ops, graph, parsers), adapters/checkov.py (the graph's K8s scanner)	PENDING(decision: portfolio graph layers)
metrics/ (ops, history, spend, collect_spend, attribute_spend), registry/ops.py + models.py (engine.models.spend_row, pricing)	PENDING(decision: metrics journal)
engine.py (facade: ctx, metrics, models, adapters, sweep, portfolio), _ops_base.py, locations.py, storage.py, assets.py, adapters/_contract_bridge.py, data/secure-code-audit/opengrep-rules/	the decisions above (each module's docstring names which)
ops/	the continuous-ops service (stays)

Reachability, proved: an AST import walk from traust#291's entry points (HarnessEngine, locations.SWEEPS_REL, sweep.engine, sweep.benchmark, sweep.rule_lane, adapters.opengrep, portfolio.graph, the facade's ops) and from ops/ reaches exactly the kept set. One attribute hop the import walk can't see: sweep/rule_lane.py calls engine.adapters.rule_pack_dir() / rule_pack_allowlist_path(). So adapters/ops.py and the facade's .adapters stay too, which lane (f)'s list missed. Every symbol traust#291's src/ uses was resolved against this branch (HarnessEngine.load() plus each facade method and module attribute).

ops/ imports: only traust_core and ops/ itself. Nothing in ops/ imported a deleted module, so nothing had to switch.

Legacy files

File	Verdict	Where it went / why
_util/ (safe_exec, elf, redact, script_loader)	Retire (moved)	core ProcessRunner + safe-exec policy, ELF fact enumerator (core #205)
toolchain/	Retire (moved)	core tool catalog (#205)
adapters/ gitleaks, grype, govulncheck, joern, yara, osv, osv_sbom, cloud_config, crypto_audit, crypto_probe, detection_quality, fleet_fix, compliance_sources, tools.py, providers.py (register_providers)	Retire (moved)	core tool providers (#211, #212, #209, deps) and the register_* doors core calls itself. Crypto reuses core's CryptoProbe and friends
reporting/	Retire (moved)	core ReportingService (#213, #215)
compliance/, data/compliance/	Retire (moved)	core compliance sources; the mapping ships in traust's security pack (lane d)
osv/, depsdev/	Retire (moved)	core deps providers
validation/	Retire (moved)	core scope and soundness gates
registry/products.py, registry/feeds.py	Retire (moved)	PortfolioService products / ctx.product_lookup; core feeds
escaping.py	Retire	its only emitters (reporting, compliance dashboards) are gone; core rendering escapes its own output
data/secure-code-audit/gitleaks-rules/, assets.default_gitleaks_config, assets.compliance_data_dir	Retire	nothing left reads them; traust#291 ships the gitleaks config in packs/security/
ContextOps.safe_exec_profile_map	Retire	only the deleted adapters called it
pyproject.toml jsonschema, referencing	dropped	only reporting/validate.py imported them (tests still get jsonschema through core)

Kept: locations.py, _ops_base.py and engine.py, which the brief listed for deletion. They are what the pending ops call (see Scope).

Changed tests

Every changed or deleted test exercised code this PR deletes. No assertion on kept code changed.

• A person reviewed each changed test and the behaviour change is intended

Test	Old → new	Why
test_adapter_contract_boundary: test_native_secret_scanner_identity_is_not_a_domain_fingerprint, test_grype_package_locations_survive_conversion, test_native_unknown_scanner_severity_cannot_be_relabelled_as_low	deleted	gitleaks/grype adapters deleted (core providers). The _contract_bridge tests stay
test_bundled_rule_packs: …_resolves_to_the_bundled_gitleaks_config, TestBundledGitleaksConfig::test_default_scan_reports_a_traust_detector	deleted; docstring drops gitleaks	gitleaks adapter and bundled config deleted; traust's test_default_rule_packs runs the pack's copy
test_config: test_resolve_gitleaks_config_uses_locations, …_rejects_remote_uri	deleted	gitleaks adapter deleted
test_config::test_bundled_defaults_exist_on_disk	default_gitleaks_config().is_file() line removed; the rule-pack assertion is unchanged	that config no longer ships
test_traust_engine: test_compliance_reference_data_ships_with_the_engine, test_compliance_ops_use_configured_paths, test_toolchain_ops_external_tools_from_context, the three safe_exec profile tests	deleted	compliance, toolchain and safe-exec deleted
test_traust_engine::test_namespace_ops_are_cached_per_engine	compliance / reporting / toolchain lines removed; the rest unchanged	those namespaces left the facade
tests/conftest.py	autouse safe-exec profile bind removed, and with it the unbound_safe_exec marker	_util/safe_exec deleted

Deleted test files (658 test functions; their code moved to core, see Legacy files)

test_adapter_observation_publication 1, test_cloud_config_provider 28, test_compliance_sources 10, test_crypto_audit_scope 4, test_crypto_probe 47, test_depsdev 20, test_detection_quality_sources 15, test_escaping 5, test_export_sarif 23, test_fleet_fix_applier 15, test_joern_reachability 13, test_lint_threat_model 41, test_native_adapter_artifact 1, test_osv_api_adapter 25, test_osv_client 10, test_osv_sbom 15, test_product_definitions 22, test_redact 8, test_register_providers 11, test_resolve_compliance_scope 15, test_review_surface_validation 28, test_run_gitleaks 11, test_run_govulncheck 13, test_run_osv_scanner 4, test_run_yara 12, test_safe_exec 27, test_safe_exec_wiring 3, test_scanner_db_wiring 10, test_script_loader 1, test_threat_model_review_surfaces 7, test_threat_rating 20, test_tool_providers 22, test_toolchain 25, test_toolchain_e2e 32, test_validate_report 113, test_vuln_findings_baseline 1. Also deleted: fixtures tests/fixtures/cloud_config/ and fleet_fix/ (only those tests read them).

Housekeeping

README (now the ops service plus the kept-for-traust table; dropped the rows for gitleaks_config, product_definitions, sarif_tool_uri and SAFE_EXEC_DISABLED, which nothing reads any more), CONTRIBUTING (integration needs opengrep only), the package docstring, CODEOWNERS (rows for deleted files), .github/secret_scanning.yml (the gitleaks-rules path), and the pytest marker text.

Behaviour changes

None to kept code. HarnessEngine loses .compliance, .reporting and .toolchain, and ContextOps loses safe_exec_profile_map. traust#291 calls none of them.

Validation

$ make lint-fix && make test
All checks passed! / 82 files already formatted
512 passed, 4 skipped, 5 subtests passed          (full incl. integration: 515 passed, 4 skipped)
$ git show upstream/development:.ratchet.json > /tmp/engine-ref.json
$ uvx --from "$RATCHET" python -m traust_core.v1.checks.ratchet src --rules consumer --baseline .ratchet.json --reference /tmp/engine-ref.json
(clean; the baseline only shrank: 18 deleted files' entries removed, the rest unchanged)

Core pin unchanged (efd2797, on development). Pre-commit and pre-push hooks passed. I didn't watch CI.

Merge order

1. traust-core #225, #223, #222, #229
2. traust lanes a–e, then traust#291 (lane f)
3. traust-engine test(ops): record keeps a refused answer's reason; loop-over-the-pack coverage from traust (XWING-2440) #112
4. this PR

What's left (one follow-up after Shaun's three decisions)

• Delete the kept modules above, then drop traust-engine from traust.
• When traust re-pins to this commit: delete traust's parity tests tagged # delete with the engine that read deleted modules (test_adapters_core_parity reads _util and the other adapters; test_registry_doors reads registry.products). traust's own repoints are due at the same time: the SKILL.md allowed-tools lines for python3 -m traust_engine.reporting.render / .lint (cloud-config-audit, secure-container-audit, threat-register) and the prose naming traust_engine.escaping.md_cell (track-findings). Those modules are gone here.

Quality checklist

• Comments only for the non-trivial (PENDING markers only)
• Docstrings don't bloat
• Don't reinvent (deletions only)
• Shared logic is a helper, in one place
• Tests cover the edges (kept code's tests unchanged)
• Integration tests (opengrep integration tests pass locally)
• Minimal, clean code
• Queries: none
• Tests change only on purpose (table above)
• Auto-merge: not set; this PR deletes existing tests

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment