refactor: retire Network, managed Sandbox, and Bridges - #681

What & why

Remove Network, managed Sandbox, and Bridges as product capabilities throughout CompozyOS. This is an intentional hard cut: the retired products no longer have runtime implementations, discoverable commands, API routes, native tools, SDK contracts, configuration, Web applications, or active product documentation.

The accepted scope explicitly preserves HEARTBEAT, SOUL, Tasks, autonomy, Goal, local ACP sessions, Loops, memory, session supervision, and attention notifications. The original cleanup analysis is superseded wherever it proposed removing those surviving capabilities.

This change was implemented and verified by OpenAI Codex, with specialist agents working on the individual surfaces. The evidence below is automated and agent-operated local validation; it does not claim human review or external-provider validation.

Compatibility decision

The repository owner explicitly authorized removal without backward compatibility for these three products. There are no compatibility aliases, deprecation-only shells, replacement messaging products, or managed remote Sandbox implementations. This is a deliberate exception to the usual compatibility window.

Generic transport networking, provider-native execution/confinement policies, MCP/ACP adapters, and Herdr IPC remain: they are infrastructure for retained functionality, not the retired product capabilities.

Implementation by surface

Database migration and data disposition

internal/store/globaldb/schema/migrations/00121_retire_network_bridges_sandbox.sql removes 37 retired tables and rebuilds 21 retained tables.

The migration deliberately removes:

• Network state and Network wake runs, including dependent records.
• Bridge instances, routes, deliveries, task subscriptions, resource records, and ingress bindings.
• Retired notification presets and delivery permits.
• Product-specific fields on retained records, retired credentials/resources, and Loop channel-message events.
• Network-owned task triage rows; retained daemon triage identities and flags are preserved without aliasing retired actors into them.
• Task/task-event references to removed Network wake runs, so retained records do not point at deleted runs.

It preserves retained sessions and their local histories, ordinary Task runs, Tasks, execution profiles, workspaces, Loops, memory, attention, Task status cursors, designations, authored SOUL/HEARTBEAT content and revisions, and surviving Gateway consent.

Upgrade preparation: back up daemon state and workspace .compozy/ directories, and export any retired history with the previous release before upgrading. The retired state cannot be recovered from the upgraded database. There is no in-place downgrade; recovery means restoring a complete pre-upgrade backup before starting an older binary.

Migration guidance is shipped in MIGRATION_GUIDE.md, packages/site/content/docs/migration/index.mdx, and the breaking-change release note .release-notes/retire-network-bridges-sandbox-1790467200.md.

Gateway remains supported

The old Network-named consent fields are renamed to Gateway fields while preserving the stored digest, confirmer, and timestamp. Extension manifests and describe results now use:

• [gateway]
• gateway.private and gateway.public
• gateway_requirement_digest
• --confirm-gateway-requirement and confirm_gateway_digest

A changed requirement still requires explicit digest confirmation. The stored consent tuple records the previous authorization; it does not make an old manifest compatible or authorize a rebuilt artifact automatically. Legacy network_participation declarations must be rebuilt using [gateway] and their current digest confirmed. The loader rejects those legacy declarations explicitly in both TOML and JSON with actionable guidance. No Bridge ingress subject remains supported.

Preservation fixes exposed by the removal

The cleanup also repaired specific retained behaviors whose dependencies or assumptions were exposed during validation:

• Task review continuation: inherit the parent run's effective workspace, including globally scoped Tasks. The existing review regression passed without changing its assertions.
• Task status and designation: retain designation storage, independent status-cursor projection, observer fanout, and completion replay after removing Network ownership.
• Loop judge work: associate temporary judge sessions with their parent Loop run using the existing execution registry, retaining the association through revocation until cleanup joins.
• Clarification keepalive startup: register the 30-second ticker before exposing the first ping. Pre-publication aggregate validation reproduced an intermittent zero-cadence observation; the production ordering fix preserves the existing test unchanged and is covered by 100 repeated race-enabled runs. This adapter is retained infrastructure, not the removed Bridges product.
• Session stop/cancel: wait for pending stop finalization before closing the recorder, preserving concurrent CancelTurn/RequestStop behavior.
• Workspace isolation: load configuration for the explicit home, preserving isolated runtime configuration.
• Local ACP E2E fixture: retain the generic local fixture under local_fixture.json and update its consumers; four real worktree journeys continue to pass.
• Retained test coverage: restore surviving HTTP/UDS/session/workspace/claim/lease assertions from mixed feature files; retain cancellation fencing, token redaction, idempotency, filtering, attribution, oldest-session ordering, and coordinator reuse coverage.
• Large-change gate selection: consume the complete scope list before reducing mixed Go scopes to ./..., avoiding a pipefail/SIGPIPE failure on large changesets. The existing integration suite reproduces the case with 1,026 changes; unknown paths still fail closed.

How you verified it

Final local gate

make gate passed for final remediation tree 08789b565399f1879debd7429d02d64e92e8e316, published in commit 8d0d5ebc3c169ef55b83b8d1c65f2c98a9da4077. All seven lane records are CURRENT-PASS for that exact tree.

Validation ran in an isolated worktree containing only this PR's corrections. Concurrent design/skill edits and other machine workloads were preserved. Go packages ran one at a time using the supported COMPOZY_GO_TEST_P=1 option, with four parallel tests per package, race detection, and unchanged deadlines/assertions. Earlier historical-migration timeouts under heavy host load did not recur in the final complete run; no test or production behavior was changed to bypass them.

The full Go command used the repository's canonical modernc race configuration:

CGO_ENABLED=1 go test -race -gcflags=modernc.org/...=-d=checkptr=0 \
  -p 1 -parallel 4 -timeout 45m ./...

The gate unsets runtime-home/provider variables to isolate the suite. Root Turbo covered Web (687 suites, 6,671 tests), UI (787 tests), site (301), Desktop (137), TypeScript SDK (62), React SDK (13), and lint plugins (47). Pre-commit tasks passed manually with --no-stash --no-revert to respect the owner's prohibition on Git stash; the commit contains exactly the validated tree.

Additional executable evidence

• Previous-version populated SQLite migration, reopen, foreign-key validation, and retained-state assertions.
• Byte/hash verification of all 120 historical migrations and their existing Atlas entries.
• All packages compiled with integration tags; focused real integration/race suites covered CLI, HTTP/UDS, native tools, Gateway/extension installation, daemon lifecycle, local ACP, Task resume, automation, context/reentry, and hosted MCP.
• Session/ACP/terminal/workspace race suites and Windows cross-build.
• Four real daemon/CLI worktree E2E journeys using the retained ACP fixture.
• Real SQLite coverage for judge work association, review continuation, and human-cancel/stale-completion fencing with token redaction and preserved attribution.
• Site production build (2,139 pages) and 14-URL production HTTP smoke.
• Active-source residual searches found no retired public IDs, runtime dependencies, or provider contracts in the audited surfaces. Historical migrations/releases and generic infrastructure are intentionally retained.
• git diff --check passed.

Real application QA

The committed report is docs/qa/reports/2026-09-27-pkgs-cleanup-real-runtime.md. Two bounded local charters passed through the actual CLI, HTTP, UDS, daemon-served production Web, and an isolated real Chrome browser:

1. Retired product catalogs: command/config/tool rejection; absence from public catalogs, dock, palette, settings, and notifications; 404 responses before and after daemon restart; retained Task create/edit/enqueue/read across public surfaces.
2. Authored-context persistence: SOUL/HEARTBEAT validation, writes, reads, history, rollback, delete/recreate, stale-write CAS conflicts over HTTP/UDS, workspace/profile isolation, and exact content/digest/revision preservation after restart. The Web editors displayed the restored content.

The targeted evidence auditor passed with zero blockers and zero warnings. Lab teardown reported clean: true with no survivors; unrelated runtimes and the personal browser were not targeted.

Current Web capture used by the site:

Evidence boundaries

• The bounded real-app walk did not execute external providers, a live Goal, an eligible Heartbeat wake, session Soul refresh, or external webhook delivery. Broader scenario rows remain explicitly skipped for omitted legs.
• Owning integration tests and real-app observations are distinct evidence; an enqueue with the scheduler paused is not proof of provider execution.
• The site was built and checked over production HTTP; no independent rendered-site browser review is claimed. The Web capture above is from the actual application.
• Raw local receipts are retained under .cache/pkgs-cleanup/ and the isolated QA lab. Those ignored local artifacts are not GitHub-hosted attachments; the committed QA report and this description summarize the evidence.
• Required GitHub CI for the published head is tracked separately below. Local success is not a CI-success claim.

Impact

This is a breaking change across CLI verbs/flags/output, HTTP/UDS routes and DTOs, native tools, hooks, extension manifests/host contracts, SDKs, configuration, persisted state, and Web/Desktop surfaces. Public consumers must remove retired feature usage and rebuild against the current contracts.

Official guidance in skills/compozy/, site docs, migration documentation, release notes, and QA scenarios is updated in the same change. The cross-surface audit is recorded in docs/_memory/change-impact.md.

The large diff includes coordinated generated OpenAPI/SDK declarations and deletion of the retired implementations and their dedicated tests/docs. Review migration/state preservation first, then surviving runtime boundaries, public/generated contracts, and finally UI/docs/tooling.

Review remediation and current CI

Published head: 8d0d5ebc3c169ef55b83b8d1c65f2c98a9da4077. All applicable current-head checks are green: 35 SUCCESS, zero failures, zero pending. The 17 SKIPPED jobs are conditional release, dry-run, nightly, and opt-in integration lanes. Main CI completed successfully, including all eight Go shards, all four Web E2E shards, runtime/Desktop E2E, frontend, Windows runtime, and preflight. React Doctor, CodeRabbit, and Vercel also passed. Greptile re-reviewed this exact head with a 5/5 score and both original threads resolved. The seven local gate records remain CURRENT-PASS for the published tree.

The remediation commit addresses the review and CI findings:

• Greptile: triage identity collision. Migration 00121 deletes triage rows owned by retired Network actors instead of relabeling them as daemon actors. The existing populated-database upgrade/reopen suite first reproduced the UNIQUE collision, then passed with the retained daemon identity and flags unchanged. All 120 historical migrations and Atlas entries remain intact.
• Greptile: legacy Gateway provider trust. Automatic manifest translation would conflict with the explicitly authorized hard cut. TOML and JSON network_participation declarations now fail explicitly with instructions to rebuild using [gateway] and confirm the requirement digest. Migration/release documentation explains that preserving a historical consent tuple does not authorize a rebuilt artifact automatically. Owning manifest/digest tests and real CLI refusal checks passed.
• Runtime fixture CI. The existing real daemon/CLI E2E now asserts both messages emitted by the retained local ACP fixture (alpha says hi and alpha follow-up). Its race-enabled focused run passed.
• Gateway Web CI. The operator journey verifies the surviving signed-webhook disclosure. The real daemon-served scenario passed.
• Task publish Web CI. Remove the obsolete empty Network-participation PATCH and require absence of retired coordination controls, while preserving publish, active-run, and run-history assertions. The real daemon-served scenario passed.
• Window restoration Web CI. Capture the initial window-manager response once so later refreshes cannot overwrite the restore baseline. The original nonnegative and sub-500 ms assertions remain unchanged. The real 12-window journey passed at 117.6 ms.
• React Doctor. Extract cohesive rendering sections/query presentation within the six owning files. The CI-pinned 0.9.13 scanner reports zero issues locally, without suppressions.
• Product-language preflight. Restore the preexisting proper-name exception for historical Compozy Network references; active migration documentation uses current product naming. Historical generated release files remain unchanged.

The two non-blocking notes in the follow-up review were checked against the existing contracts: the proper-name regex exception is identical to origin/main and preserves historical release text; the benchmark installs its observers at document start on reload and now freezes the initial response baseline, matching the already-once-only window-placement timestamp. Neither change relaxes the measured bounds or asserts retired runtime support.

The three focused real Web E2E scenarios passed together using the owning Web Playwright binary and canonical machine-wide verification lock. The production Web build passed. No merge or release is requested.

• Final remediation tree passes make gate; all seven lane records are CURRENT-PASS
• Changed behavior is covered by owning tests and bounded real-app QA, with exclusions documented above
• Agent authorship and automated verification are identified above; human review is not claimed
• All applicable current-head GitHub CI checks are green; conditional jobs are explicitly listed as skipped