[diegosouzapw]

Summary

Rail 3.8.55, Task 13: boundary remeasurement and an expanded provider-journey E2E, ahead of the v4 split of open-sse/ (engine) from src/lib/* (modules). No production code changes.

1. scripts/quality/measure-boundary.mjs (npm run quality:boundary): a reproducible, deterministic measurement of src ⇄ open-sse coupling, replacing the hand-built tables from the characterization tasks.
2. Multi-format provider journey: two companion contract suites to provider-journey.contract.test.ts (test(e2e): contract test for the full provider journey #8330). One covers the Claude format, one covers the Gemini client format. Both run against a fake upstream on an ephemeral 127.0.0.1 port, with no external network.

What changed

File	Change
scripts/quality/measure-boundary.mjs	New. It scans src/**/*.ts(x) and open-sse/**/*.ts(x) and skips node_modules, .next, tests/, __tests__/ and *.test/*.spec files. A small lexer strips comments, string contents, template text and regex literals. The script then extracts static imports, re-exports, side-effect imports, import() calls and require() calls. It resolves @/, @omniroute/open-sse[/…] and relative paths, including ../../src/... escapes. Edges are counted as unique (importing file → imported file) pairs, grouped by subsystem of origin (src/lib/<name>, src/app/api/<route>, src/<dir>, open-sse/<dir>). Output is --json or --md. The JSON also includes openSseToSrcEdges, the full engine→app list, which is the v4 remediation input. Only node:fs, node:path and node:url are used; there is no child process and no shell.
tests/unit/measure-boundary.test.ts	New. 7 tests on a fixture tree in a temp dir. They cover aliases, a bare @omniroute/open-sse import, a relative escape, import(), require(), type-only imports, commented-out imports, test/__tests__/node_modules/.next exclusion, dedupe, subsystem aggregation, determinism, Markdown output, and the CLI.
package.json, config/quality/gate-manifest.json	quality:boundary alias, registered as separately-invoked. It is a report only, not a gate.
tests/integration/_providerJourneyHarness.ts	New. Contains the fake upstream, which records every request, and a loopback shim. The shim serves the sync route's self-fetch from the in-process /models route, so the real sync path runs.
tests/integration/provider-journey-claude.contract.test.ts	New. It walks this path: anthropic-compatible node → connection → real model sync (upstream /models receives x-api-key) → /v1/models publishes <prefix>/<model> with owned_by = prefix and never the UUID (#8327) → POST /v1/messages, both JSON and SSE. The upstream receives /v1/messages with the raw model id, the connection key, and the system and user turns. The client receives a Claude message or an Anthropic event stream, with no OpenAI shapes.
tests/integration/provider-journey-gemini.contract.test.ts	New. It walks this path: openai-compatible node → connection → real sync (Bearer key) → /v1/models owned_by = prefix → /v1beta/models/<prefix>/<model>:generateContent. The upstream receives /v1/chat/completions with the raw id and the system and user messages, and no contents. The client receives candidates[0].content.parts[0].text with finishReason: STOP. /v1beta/models lists the model.

Both suites are collected by the existing tests/integration/*.test.ts glob (test:integration, test:integration:ci).

Measurement at the release tip (cc84e9426a)

Metric	Value
src files scanned	3452
open-sse files scanned	1848
src → open-sse edges	1492
open-sse → src edges	745 (372 distinct engine files)

The engine→app direction is far from zero. The source subsystems are open-sse/services (284), handlers (258), executors (63), mcp-server (59), utils (50), config (16) and translator (15). The top targets are src/shared (266), src/lib/db (146), src/lib/usageDb (45), src/lib/usage (37), src/lib/providers (33), src/domain (26) and src/sse (21). The full per-edge list is the v4 remediation list.

Cross-check against the Task 12 hand tables: files importing open-sse match exactly (memory 21, guardrails 7, skills 7, a2a 3, oauth 18). Distinct open-sse consumers also match exactly (memory 5, guardrails 3, skills 12, oauth 6). The only difference is a2a: the script finds 0 open-sse consumers against Task 12's 1, because that consumer is a vitest file, and test files are excluded here by design.

Findings

• fix(models): /v1/models exposes internal provider UUID as namespace, ignores configured prefix, multiplies effort variants #8327 residue on the Gemini catalog. /v1beta/models names custom-provider models models/<raw provider-node UUID>/<model>, which is the identifier that fix(models): /v1/models exposes internal provider UUID as namespace, ignores configured prefix, multiplies effort variants #8327 removed from /v1/models. The Gemini suite records this as a todo step, so it shows up in every run without turning CI red. It needs a follow-up fix in src/app/api/v1beta/models/route.ts.
• GET /v1beta/models has no auth. The handler takes no request, so requireAuthForModels is not applied to the Gemini catalog the way it is to /v1/models. Reported here for triage; no test pins it.
• The native gemini executor ignores a per-connection base URL (case "gemini" in open-sse/executors/default.ts), and provider nodes are only openai- or anthropic-compatible. A fake Gemini-format upstream therefore cannot be wired without mocking fetch, so the Gemini journey uses a Gemini client against an OpenAI-compatible upstream.

Validation

Gate	Command	Result
Unit (new)	node --import tsx/esm --test tests/unit/measure-boundary.test.ts	7/7 pass (red before the script existed)
Integration (new + existing journey)	node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 tests/integration/provider-journey{,-claude,-gemini}.contract.test.ts tests/unit/measure-boundary.test.ts	34 tests: 27 pass, 0 fail, 6 skipped (live block, RUN_CONTRACT_INT), 1 todo
Mutation check	Return the raw OpenAI response from the /v1beta generate route	STEP 5 of the Gemini suite fails as expected (reverted)
ESLint	npx eslint <changed files>	0 problems
Typecheck	npm run typecheck:core	clean
Dead code	npm run check:dead-code	OK: 370 (baseline 377)
Test discovery	npm run check:test-discovery	OK
Gate manifest	node scripts/quality/gate-manifest.mjs	OK (137 aliases)
Pre-commit	lint-staged, docs-sync, any-budget, tracked-artifacts, ai-attribution	pass on both commits

⚠️ base-red inherited: #15306

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.