[jackie-cqz]

Which issue or RFC does this PR close?

No tracking issue. This follows up on the Artifact Processing Supervisor
(RFC 1515, #1523),
which replaced the APScheduler path removed here.

Rationale for this change

A static import scan of src/powercontext (module-level, deferred, and TYPE_CHECKING imports) found lower layers
importing upper ones:

Edge	Imports before	After
builtin → server	23 (16 deferred into function bodies)	1 (annotation-only TYPE_CHECKING)
builtin → client	1	0
server → cli	3	0
service → cli	3	0

The deferred imports hid a cross-layer cycle: server/processing_security.py imported the runtime composition root at
module level while the runtime imported it back inside functions. Separately, the in-process APScheduler activation
path stayed in the runtime after #1523 removed its only caller.

What changes are included in this PR?

Three commits that can be reviewed one at a time:

1. refactor(runtime): remove the legacy APScheduler scheduling path

   • Delete builtin/runtime/scheduler.py, BuiltinRuntime.start_scheduler, ScheduledSourceProcessor,
     ScheduledExperienceProcessor, the access-scoped scheduled runners in server/factory.py, and the Scope
     enumeration helpers that only fed them, together with their tests.
   • scheduler_path on open_builtin_runtime and create_server_app is deprecated: it is ignored and emits a
     DeprecationWarning. powercontext.paths.default_scheduler_path is removed.
   • APScheduler stays a dependency because cron bindings parse expressions with CronTrigger.
   • In-repository callers (98 keyword arguments across tests, examples, and scripts) and docs no longer pass or
     describe the scheduler sidecar.

2. refactor(authz)!: move access control into the built-in runtime

   • powercontext.server.authz → powercontext.builtin.authz. It already depended only on Core and built-in
     persistence.
   • Processing-child security (WorkerSecuritySpec, WorkerSecurity, open_worker_security) moves to
     builtin/authz/worker.py. build_worker_security stays in server/processing_security.py because it reads
     ServerSettings.
   • DreamAuthorization (builtin/authz/dream.py) holds the recorded-principal checks processing children need. The
     Server's DreamAccess subclass adds the request-principal Review checks and request IDs.
   • The powercontext code command moves to powercontext.cli.code; the entry point is updated and the command is
     unchanged.

3. refactor: move shared helpers out of the cli and client packages

   • powercontext.cli.env_file → powercontext.env_file (standard library only).
   • powercontext.cli.inference_notice → powercontext.server.inference_notice.
   • Credential redaction primitives → powercontext.redaction; powercontext.client.capture keeps capture-event
     rendering and uses them.

4. Merge branch 'master' (eleven merges): resolves conflicts with the reusable database upgrade framework
   (feat(migrations): complete the reusable database upgrade framework #2168), durable owner recovery (feat(authz): recover external owner writes from durable intents #2187), dedicated database provisioning (feat(storage): provision dedicated seekdb and oceanbase databases #2031), and the managed plugin
   framework (feat(artifact): add managed plugin framework and some example #2246), plus the v1.5.0 release preparation (chore(release): prepare v1.5.0 and refresh product screenshots #2395) and ownership migration when enabling
   enforcement (fix(access): support ownership migration when enabling enforcement #2304)

   • Keeps upstream's deployment_runner(settings, ...) and server/database_migration.py. The framework needs the
     full Server settings, so the access-control move no longer narrows that signature. This leaves one
     annotation-only (TYPE_CHECKING) builtin → server import, in
     builtin/persistence/migrations/deployment.py.
   • Points the upgrade release gate's MANAGED_INPUTS and its tests at src/powercontext/builtin/authz.
     managed_digest skips a missing directory silently, so without this the gate would have stopped covering
     access control.
   • Places feat(authz): recover external owner writes from durable intents #2187's new owner_recovery.py under builtin/authz and rewrites its imports, server/app.py,
     server/factory.py, and the new owner-recovery tests for the new package path. The only code from that PR in
     the scheduled-runner helpers this PR deletes was the owner-recovery session threaded through them; with no
     caller left, the helpers stay deleted.
   • For feat(storage): provision dedicated seekdb and oceanbase databases #2031: keeps both import sets in server/cli.py, takes the new test setup in
     tests/test_atomic_memory_migration_cli.py, and follows the moves into code that arrived with the merge: the
     new source_management gateway and the agent-tool-recovery evaluation server import access control from
     builtin.authz, tests/test_cli.py imports and patches the code command at powercontext.cli.code, and
     the two scheduler_path arguments added upstream are dropped.
   • Updates release/upgrade-support.json: the persistence digest, plus one rationale sentence in the existing
     style, kept alongside the rationale upstream added. The generated table and index DDL for all 76 persistence
     and access tables, including pc_access_owner_recovery, pc_source_write_plugins, and the plugin framework's
     tables, is identical to master on the SQLite and MySQL dialects, so no table layout or migration encoding
     changes. This is a maintainer-owned declaration; please confirm the wording.
   • For feat(artifact): add managed plugin framework and some example #2246 and the 36 other commits in the latest merge: upstream edited server/authz/profiles.py and
     service.py after this branch had moved them, and git applied those edits to builtin/authz. The new
     plugin-framework modules under builtin/runtime and their tests import access control from builtin.authz
     and the worker-side security from builtin.authz.worker, so the framework adds no new builtin → server
     import. Three follow-ups the merge needed: the perf_counter import that the first commit removed is
     restored because PreparedContext receipts (feat(context): add bounded PreparedContext receipts #2258) use it, two new tests (fix(tests): initialize native Code Server storage before seeding #2348) stop passing the removed
     scheduler argument to the harness helpers, and the CI change-selection test uses the new path of
     owner_recovery.py, which classifies the same way. ty found the two helper callers; a search for the
     scheduler_path= keyword could not, because they pass it positionally.
   • For the fifth merge (9c8f061c, 28 commits: the v1.5.0 release preparation (chore(release): prepare v1.5.0 and refresh product screenshots #2395), the Rust PowerContext
     Gateway executor (feat(gateway): add Rust PowerContext Gateway executor #2307) and its conversation-scoped injection (feat(gateway): inject prepared context into Responses requests #2400, fix(gateway): prepare once per user message within a conversation and replay it #2416, feat(gateway): inject by default in combined deployments for host conversations #2417), historical Server upgrade
     paths (fix(migrations): support historical Server upgrade paths #2394), and the final request and response privacy checks with their input-encoding evaluation (feat(inference): enforce final request and response privacy checks #2311)):
     the only textual conflict was release/upgrade-support.json,
     where upstream raised the target to 1.5.0 and extended the rationale for the historical upgrade paths. This PR
     keeps that text, re-appends its own sentence, and recomputes the digest; the gate passes. Six files added
     upstream still used moved or removed names: the input-encoding evaluation runner
     (evaluation/performance/input_encoding/runner.py) and four new tests passed scheduler_path, and three new
     tests imported from powercontext.server.authz. The runner's _open_runtime helper drops its scheduler_path
     parameter and the tests import from powercontext.builtin.authz; nothing else needed editing.
   • For the sixth merge (1190dcbb, 75 commits: ownership migration when enabling enforcement (fix(access): support ownership migration when enabling enforcement #2304), Source
     evidence declarations (feat(memory): persist versioned Source evidence and neutral Atomic Memory projection #2004), and Desktop Linux diagnostics (feat(desktop):add Linux disgnostics integration #2343)): fix(access): support ownership migration when enabling enforcement #2304 added
     server/authz/keys.py, which git placed at builtin/authz/keys.py by rename detection, and
     server/ownership.py, and it edited WorkerSecurity in server/processing_security.py, which this branch had
     split. The class lives in builtin/authz/worker.py, so the three bounded idempotency keys are applied there and
     processing_security.py keeps only build_worker_security. In server/app.py, factory.py, and cli.py the
     branch's builtin.authz imports are kept, plus bounded_idempotency_key and OwnerRecovery, which the new code
     uses; _scheduled_access_runners stays deleted. release/upgrade-support.json takes upstream's text for the new
     v1_5_0_002 and v1_5_0_003 revisions, re-appends this PR's sentence, and recomputes the digest. A new
     static_scope_bootstrap_would_grant method and the new ownership tests imported server.authz, and 18 calls in
     tests/e2e/test_access_ownership_migration.py plus two other tests passed scheduler_path; all are updated.
   • Upstream also raised the code-seekdb job timeout from 30 to 60 minutes in this range. The two
     code-seekdb (…, 0) failures on the previous head were that job hitting the 30-minute limit in the unified
     migrations step, and the same limit cancelled code-seekdb (3.11, 0) on master.
   • For the seventh merge (2853ed98, 2 commits: the website SEO and Markdown export changes (feat(website): improve SEO, Markdown exports, and community links #2454) and the
     OpenCode setting that turns prompt-time recall off (feat(opencode): add a setting that turns prompt-time recall off #2455)): textually clean. Neither commit touches src/, so
     nothing needed to follow the moves.
   • For the eighth merge (24e0017e, 61 commits: the managed observability stack (feat(observability): add managed monitoring stack and diagnostics #2388), the shared Skills
     refactor (refactor(plugins): share standard Skills across native hosts #2380), and the SQLite connection-worker drain (fix(sqlite): drain failed connection workers #2468)): two conflicts. server/cli.py keeps
     powercontext.env_file and adds the new observability notice import. release/upgrade-support.json takes
     upstream's text, re-appends this PR's sentence, and recomputes the digest after formatting; the gate passes.
     feat(observability): add managed monitoring stack and diagnostics #2388 added cli/observability_notice.py, which only the Server's CLI uses, so it moves to
     server/observability_notice.py like inference_notice did and the Server still imports nothing from cli.
     Eight other new files imported powercontext.cli.env_file or powercontext.server.authz, and five new calls in
     tests/test_provider_observability.py passed scheduler_path; all are updated.
   • The code-seekdb (3.11, 0) failure on the previous head was the unified migrations step reaching its 25-minute
     step limit (it ran 1513 s). The merge brings in ci(seekdb): distribute native migrations across three shards #2458, which splits that step across three shards and allows it
     40 minutes.
   • For the ninth merge (da03e70a, 80 commits: Source locators with revision v1_5_0_004 and the
     pc_artifact_source_locators relation, code evidence reuse (feat(context): reuse code evidence with per-file revalidation #2425), the MiniMax native plugin (feat(minimax): add native plugin setup and verification #2205), and the
     shared integration lifecycle helpers (refactor(integrations): generate the shared Python plugin helpers from one source #2318)): one conflict, in release/upgrade-support.json. It keeps the
     sentences upstream added for those changes, re-appends this PR's sentence, and recomputes the digest after
     formatting; the gate passes. The six new tests that passed scheduler_path (15 arguments) are updated. The new
     cli/minimax.py is imported only inside the CLI package, so it stays in place.
   • For the tenth merge (c4c95e46, 8 commits, among them native minimum_should_match filtering for OceanBase
     Atomic Memory (perf(oceanbase): use native minimum_should_match filtering #2498) and request authentication before body reads (fix(server): authenticate requests before reading their bodies #2512)): one conflict, in
     release/upgrade-support.json, resolved the same way. No merged commit adds a reference to a moved or removed name.
   • The failing CI on the previous head was the same 7 tests as in the test notes below, and master's own Main
     fails on them too: tests (3.11, e2e) failed with those 7 on ee3c1ee3, and tests (3.11, unit) failed on
     c4c95e46 with the Atomic Memory scoring test below. The jobs for other Python versions and Upgrade release gate were cancelled or skipped as a result.
   • For the eleventh merge (cfdb617c, 6 first-parent commits): textually clean. It brings in upstream's fixes for
     both failures above: the reconciliation tests now expect SourceSequenceLocator(sequence=…), and test(oceanbase): complete scoring connection double #2552 completes
     the scoring test's connection double. The 29 tests in those two files pass on the merged tree. No merged commit
     adds a reference to a moved or removed name, and the persistence digest is unchanged.

5. test(release): import the access-control types the installed release ships

   • The upgrade acceptance runs tests/release_upgrades/authorization_fixture.py under each installed release's
     own interpreter, before and after migration. The path rewrite in commit 2 made it import
     powercontext.builtin.authz, which PowerContext 1.3.0 does not have, so every 1.3.0 case failed with
     ModuleNotFoundError before migration started. The fixture now chooses the package with
     importlib.util.find_spec, and both the source and target authorization checks are unchanged.

Reverse edges that remain and are out of scope: server → service (5 imports in database_migration.py, where
db-migrate stops the personal service before migrating, and in the newer database_admission.py), and one
core → builtin import in artifacts/indexes.py that #2246 introduced and this PR does not touch.

Are there any user-facing changes?

For Python SDK and embedding users, yes. There are no HTTP, MCP, CLI, configuration, or persisted-format changes.

• Breaking: import access-control types from powercontext.builtin.authz instead of powercontext.server.authz.
  No alias is provided, because aliasing the old package path would load its submodules a second time and break
  isinstance checks. Jupyter tutorial 13 is updated.
• Breaking: powercontext.cli.env_file is now powercontext.env_file. default_scheduler_path and the
  ScheduledSourceProcessor / ScheduledExperienceProcessor exports are removed. known_secret_values and the
  sensitive-key constants are imported from powercontext.redaction; render_capture_event is unchanged.
• Deprecated: the scheduler_path keyword on open_builtin_runtime and create_server_app.
• Docs: the core protocol and remote-access development guides, the interfaces guide, and a status note in RFC 0019
  are updated in both locales.

How was this change tested?

• After the latest merge of master (4c527bb0): uv run python -m pytest -n auto --doctest-modules gives 9942
  passed, 1064 skipped, 8 failed. All 8 are
  tests/evaluation/test_jev_rerank_comparison.py::test_comparison_billing_through_persisted_candidates cases, and they
  fail with PydanticAIConfigurationError because ANTHROPIC_BASE_URL is set in my shell. They fail identically on an
  unmodified checkout of master (cfdb617c) (8 failed, 29 passed in both trees), and with ANTHROPIC_BASE_URL,
  ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN unset the file passes (37 passed). The 7 reconciliation tests and the
  scoring test that failed in the previous run now pass. The timing-bound scheduler test that failed in the two runs
  before did not fail in this one.
• Every component of make check passes on 4c527bb0 when run separately: version-check, pinned workflow actions,
  integration-manifest-check, integration-guidance-check, upgrade-policy-check, uv lock --locked, all 11
  prek hooks, and ty check for the package (no diagnostics) and for the Pydantic AI integration. I ran them one by
  one because make check itself stopped on a network error while prek fetched its hook repositories on my machine.
• test_enforced_mode_cannot_silently_start_without_authentication_or_provider depended on validation inside the
  removed scheduled runners. It now checks the background-principal guard through build_worker_security with a
  runnable family, and checks that a schedule with no runnable family is still rejected at startup.
• DDL equivalence: the table and index DDL generated from the persistence and access metadata (76 tables) is
  byte-identical between master and this branch on the SQLite and MySQL dialects.
• Added tests: scheduler_path is ignored with a DeprecationWarning and creates no sidecar, for both
  open_builtin_runtime and create_server_app.
• Each of the three original commits, before the merge: ruff, ty check, and focused tests (369, 419, and 590 passed). The second commit's batch
  also reported fixture 'migration_backend' not found for one e2e test; the same pytest arguments produce the same
  error on master, and the test passes alone and in the full run.
• Every moved or new module imports cleanly as the first import in a fresh interpreter. builtin/authz/dream.py keeps
  annotation-only imports under TYPE_CHECKING so it does not trigger the existing
  builtin.dream.service ↔ builtin.runtime import cycle.
• Upgrade fixtures (commit 5): with the published 1.3.0 wheel and a wheel built from this branch, each installed in
  its own venv and run with python -I, the previous authorization_fixture.py reproduces the CI error under 1.3.0
  and the new one imports under both. processing_fixture.py and upgrade_database_probe.py also import under
  both.
• Not run: make notebooks-test, real-service e2e (--run-real-e2e), tox across Python versions, and the
  installed-artifact upgrade acceptance matrix (upgrade-release.yml). The harness requires Linux process
  ownership and cannot run on macOS, so the migration and target-side phases are checked only by CI; only the
  policy check was run locally.

AI usage statement

Built with Claude Code. Claude Opus 5.5 did the analysis, implementation, tests, and commit split. Claude Sonnet 5.5
performed the initial read-only repository exploration through subagents, resolved the merge conflicts, and updated
this description. Changes were validated with the commands listed above.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[jackie-cqz]

The only failing check is tests (3.12, e2e). The failure is in tests/e2e/test_zcode_service_chain.py::test_zcode_source_is_processed_and_recalled_in_a_new_session: the ZCode scope script that the test runs exits with {"status":"failed","code":"timeout"} (job log).

This looks like a flaky test rather than something this PR introduced:

• The same test failed on unrelated PRs, for example run 40270843221 and run 40270828704, which are dependabot GitHub Actions bumps.
• tests (3.11, e2e), tests (3.13, e2e) and tests (3.14, e2e) all pass on this PR.
• The test passes locally (3 of 3 runs).

Could a maintainer please re-run the failed job? I don't have permission to re-run it myself.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[hireview001]

• Resolve merge conflicts with the target branch.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[hireview001]

• CI failed: Upgrade release gate (failure).
• CI failed: upgrade-acceptance / Verify the selected upgrade matrix (failure).
• CI failed: upgrade-acceptance / Upgrade 1.3.0 / oceanbase / full-server-code (failure).
• CI failed: upgrade-acceptance / Upgrade 1.3.0 / sqlite / full-server-vector (failure).
• CI failed: upgrade-acceptance / Upgrade 1.3.0 / oceanbase / full-server-vector (failure).
• CI failed: upgrade-acceptance / Upgrade 1.3.0 / sqlite / full-server-code (failure).
• CI failed: upgrade-acceptance / Upgrade 1.3.0 / seekdb / full-server-vector (failure).
• CI failed: upgrade-acceptance / Upgrade 1.3.0 / oceanbase / full-server-vector-code (failure).
• CI failed: upgrade-acceptance / Upgrade 1.3.0 / oceanbase / full-server-no-vector (failure).
• CI failed: upgrade-acceptance / Upgrade 1.3.0 / sqlite / full-server-vector-code (failure).
• Additional CI issues: PR checks.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[hidb4ai]

Reviewed 1e487049 against 9c8f061c. The historical-release authorization import regression is fixed, and the required 1.3.0 upgrade matrix and Upgrade release gate pass. I found no remaining PR-introduced blocking defect; the database table/index definitions and HTTP/MCP operation contracts are unchanged.

The CI result is still red because the Python 3.11 and 3.14 code-seekdb shard-0 jobs exceeded their 30-minute job limit; the same shards also time out on master. @jackie-cqz Please obtain successful completion of these checks before merging. This approval does not certify those unfinished shards.

[hidb4ai]

@jackie-cqz The head is still 1e487049, and my approval for that commit remains valid. The required CI gate is still blocked by the cancelled code-seekdb Python 3.11 shard 0 and Python 3.14 shard 0. Both exceeded their 30-minute job limit, as noted in the approval.

Please obtain successful completion of these shards and the aggregate CI gate before merging. The historical-release authorization import issue is fixed; this follow-up concerns the remaining CI completion requirement.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[Alanxtl]

lgtm

[hidb4ai]

@jackie-cqz I reviewed the new head c9c9448b against 1190dcbb. The remaining gate failure has changed: Python 3.13 E2E fails in test_zcode_source_is_processed_and_recalled_in_a_new_session[True] because the scope script's bind operation returns code: timeout; Python 3.14 E2E is then cancelled by matrix fail-fast. Upgrade acceptance was selected but skipped because it depends on the test result, so Upgrade release gate fails without executing the migration matrix.

I found no new demonstrated code defect in the refactor. Local replay hit startup/flush timing limits on both head and base, so it does not establish that this PR caused the CI timeout. Please obtain a successful E2E run and complete the selected automatic upgrade matrix for this head before merging. The passing upgrade evidence and my previous approval for 1e487049 do not qualify the new artifact's unfinished acceptance.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[hidb4ai]

Reviewed a3ee50dd against 2853ed98. The merge preserves the previously reviewed runtime refactor and adds no database tables or HTTP/MCP operations relative to the current base. The earlier E2E/upgrade acceptance gap is closed on this head: all Python E2E jobs, the selected 1.3.0 upgrade matrix and Upgrade release gate pass. I found no new PR-introduced blocking code defect.

@jackie-cqz CI still needs successful completion before merging: the Python 3.11 seekDB migration shard exceeded its 25-minute step limit, with the same type of migration timeout present on the base, and macOS LaunchAgent never acquired a hosted runner because of capacity constraints. This approval does not certify those unfinished checks.

GitHub currently also reports this PR as CONFLICTING / DIRTY; please reconcile that mergeability state and obtain successful required checks before merging.

[hireview001]

• Resolve merge conflicts with the target branch.
• CI failed: CI result (failure).
• CI did not complete: native-service / macos-launchagent (cancelled).
• CI failed: code-seekdb (3.11, 0) (failure).
• CI failed: Main (failure).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[hireview001]

• Resolve merge conflicts with the target branch.

[knqiufan]

Reviewed the package moves, authorization and worker paths, and removal of the superseded scheduler. The historical-release import issue is addressed; no new blocking finding. Focused tests passed. This review does not certify the installed-release upgrade matrix or real external backends.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[hireview001]

• CI failed: CI result (failure).
• CI failed: Upgrade release gate (failure).
• CI did not complete: tests (3.14, e2e) (cancelled).
• CI did not complete: tests (3.13, unit) (cancelled).
• CI failed: tests (3.11, e2e) (failure).
• CI did not complete: tests (3.13, e2e) (cancelled).
• CI did not complete: tests (3.14, unit) (cancelled).
• CI did not complete: tests (3.12, e2e) (cancelled).
• CI failed: Main (failure). Failed steps: tests (3.12, e2e) / Run remaining end-to-end tests; tests (3.11, e2e) / Run remaining end-to-end tests; tests (3.13, unit) / Run unit tests.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.