[smith-xyz]

Plan: plans/traust-standardization/11-consumer-adoption/11-shaun-core-api-only.md (part)

Piece D of traust and traust-engine on the traust-core API only: src/traust_engine now holds ops/ and nothing else. The facade, the location shims and the version shim are deleted. No traust_contracts import is left in src or tests, and .ratchet.json is empty.

Built on lane B and lane C: this branch merges refactor/delete-portfolio (#122) and refactor/delete-sweep (#124) on top of development, which already has #121 (refactor/ops-public-imports). So until those two merge, this diff also shows their changes. My own commit is the last one, 2743593, after the merge commit 3fc3b9d.

Merge order: all lane A/B/C PRs first (#122, then #124), then this PR, then traust's refactor/core-api-only.

What changed (my commit)

File	Change
src/traust_engine/engine.py	deleted: the HarnessEngine facade. Its last caller, traust's _registry.load_engine, is deleted in the traust PR
src/traust_engine/_ops_base.py	deleted: the base class for facade namespaces. No namespaces are left
src/traust_engine/locations.py	deleted: the location accessors over contracts' Locations. traust-core's Locations owns them
src/traust_engine/assets.py	deleted: harness_version(), used only for traust_engine.__version__
src/traust_engine/__init__.py	re-exports EngineLoop and Pack only. HarnessEngine and __version__ are gone
.ratchet.json	{}: the _ops_base (contracts 1), engine (contracts 1) and locations (contracts 1, state-file 1) entries are removed
pyproject.toml / uv.lock	the unused signing extra (sigstore) and the unused requires_git marker are removed
tests/conftest.py	keeps only the private config home. The locations.yaml, ANALYSIS_RESULTS_DIR, LAAS_TOKEN and git-probe setup served deleted code
tests/fixtures/{analysis-results,progress-tracker-stub,harnessing}/	deleted: nothing reads them
README / CONTRIBUTING / AGENTS.md	rewritten for an ops-only engine: config comes from --core/--pack, the engine imports only core's public API, and no repo pins it any more

src/traust_engine/storage.py was already deleted in #122.

Parity

Capability	New home
HarnessEngine.load(config_home=…) (contracts load_context)	traust-core Context.from_file / traust's traust.context.load(). The engine service builds core's Context from --core (ops/cli.py)
locations.* accessors (workspace_dir, analysis_results_dir, progress_tracker_dir, rule_drafts_dir, feeds_cache_dir, findings_db, gitleaks_config_path, opengrep_rules_dir, require, …)	traust-core traust_core.v1.context.Locations (same names, plus Locations.require)
ContextOps (_workspace, _analysis_results, _progress_tracker)	retired: there are no facade namespaces left to bind it to
traust_engine.__version__	package metadata (importlib.metadata.version("traust-engine")). Nothing reads the attribute
ops/ (EngineLoop, Pack, controller, admission, runner, shadow, cron, cli)	unchanged

Legacy files

File	Verdict	Where it went / why
engine.py	Retire	a facade with no namespaces. Config loading is core's Context
_ops_base.py	Retire	the base class for facade namespaces, all of which are gone
locations.py	Reuse	traust-core Locations resolves the same paths (core tests/v1/context/test_locations.py checks parity with the engine)
assets.py	Retire	__version__ duplicated package metadata and had no reader
storage.py	Retire	already deleted in #122 (core ObjectStore)

Deleted tests

Test	Core test that owns the behaviour now
tests/test_locations.py::test_analysis_results_location_reads_config, ::test_unconfigured_returns_none	traust-core tests/v1/context/test_locations.py::test_locations_match_the_engine
tests/test_config.py (10 tests: workspace_dir, progress_tracker_dir, rule_drafts_dir, feeds_cache_dir read/unset/fail-loud)	traust-core tests/v1/context/test_locations.py::test_locations_match_the_engine, ::test_require_names_the_missing_location
tests/test_config.py::test_gitleaks_config_path_reads_config	traust-core tests/v1/context/test_tools.py (gitleaks config required / no local path form)
tests/test_config.py::test_opengrep_rules_dir_reads_config	retired: no caller left after #124. Core's Locations.opengrep_rules is the field
tests/test_config_resolution.py::test_env_var_wins, ::test_default_home_used_only_when_it_exists, ::test_missing_required_fails_closed, ::test_optional_returns_none_when_absent (these tested contracts' resolver)	traust-core tests/v1/context/test_home.py::test_the_environment_names_the_home_with_user_expanded, ::test_the_default_home_counts_only_when_it_exists, ::test_an_absent_required_file_names_the_home_and_its_template, ::test_an_absent_optional_file_is_none
tests/test_engine_no_self_load.py::test_no_harness_load_outside_engine_class	retired with HarnessEngine: the class it guarded no longer exists. The engine's one composition root is ops/cli.py (Context.from_file(--core))

Changed tests

Test	Old → new	Why
tests/test_config_resolution.py (module)	docstring "owned by traust_contracts" plus 4 contracts tests → docstring "traust-core's Context". test_engine_ships_no_config is unchanged	the contracts tests moved to core (above). The assertion of the remaining test is untouched
tests/conftest.py	synthesized locations.yaml, ANALYSIS_RESULTS_DIR, LAAS_TOKEN, git probe and requires_git fixture → private TRAUST_CONFIG_HOME only	their only readers were deleted (locations, storage, sweep). No remaining test uses them

• A person reviewed each changed test and the behaviour change is intended

Behaviour changes

• traust_engine.HarnessEngine, traust_engine.engine, traust_engine.locations and traust_engine.__version__ no longer exist. traust drops its dependency on traust-engine in the companion PR, so nothing imports them.
• The signing extra is gone. Nothing in the engine used sigstore.

Prose changes

None (no SKILL.md in this repo).

Done when (this repo)

$ make lint-fix && make test
All checks passed! / 28 files left unchanged
145 passed

$ RATCHET="traust-core @ git+https://github.com/traust-security/traust-core@cb9bf23fb8fe385c89224276c1ee6700d71e6e37"
$ git show upstream/development:.ratchet.json > /tmp/p11de-engine-ref.json
$ uvx --from "$RATCHET" python -m traust_core.v1.checks.ratchet src --rules consumer --baseline .ratchet.json --reference /tmp/p11de-engine-ref.json
(clean, exit 0; baseline is {})

$ git grep -nE '(from|import) traust_(contracts|ledger)|import_module\("traust_(engine|contracts|ledger)' -- src tests
(empty, exit 1)

The plan's grep also matches traust_engine, so in this repo it hits only the engine's own traust_engine.ops self-imports (src/traust_engine/**, tests/test_*.py), which are expected. No traust_contracts or traust_ledger import is left, and no import_module("traust_*").

Quality checklist

• 1 Comments only for the non-trivial
• 2 Docstrings don't bloat
• 3 Don't reinvent
• 4 Shared logic is a helper, in one place
• 5 Tests cover the edges (no new code. The deleted tests' edges are covered by the core tests named above)
• 6 Integration tests use real data, sanitized (no change)
• 7 Minimal, clean code
• 8 Queries are low latency (no queries)
• 9 Tests change only on purpose (Changed/Deleted tests above, for review)

Reviewer checks

• Each moved capability has one owner in core. No engine code was copied into traust
• Every deleted test names the core test that now owns the behaviour

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment