{
  "schema": "runx.license_boundary_manifest.v1",
  "inventory_command": "rg -n 'oauth|RUNX_CONNECT|connection_id|material_ref|credential|auth' crates --glob '*.rs'",
  "crate_classes": {
    "runx-cli": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Keep MIT. The OSS CLI does not perform hosted connect brokerage."
    },
    "runx-contracts": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Provider-neutral contracts and credential-delivery envelope stay MIT."
    },
    "runx-contracts-derive": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Provider-neutral schema derivation stays MIT; no brokerage or provider calls."
    },
    "runx-core": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Policy and authority enforcement stay MIT; no brokerage or provider calls."
    },
    "runx-pay": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Native payment governance and deterministic test effect helpers stay MIT; real rails, secrets, and provider calls remain hosted."
    },
    "runx-parser": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Skill parsing stays MIT."
    },
    "runx-receipts": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Receipt verification stays MIT."
    },
    "runx-runtime": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Keep MIT. Runtime owns local credential consumption, enforcement, sandbox delivery, and redaction only."
    },
    "runx-sdk": {
      "class": "mit-oss",
      "phase1_state": "keep",
      "decision": "Keep MIT. Hosted connect-list APIs are not exposed from the OSS SDK."
    }
  },
  "private_crate_names": [],
  "private_home": {
    "path": "../cloud/packages/auth",
    "follow_up_spec": "cloud-connect-auth-private-home-v1",
    "notes": "Private broker for hosted provider OAuth, hosted connect HTTP, BYO custody, grant issuance, and grant revocation."
  },
  "banned_identifiers": [
    "oauth_required",
    "oauth_poll",
    "authorize_url",
    "RUNX_CONNECT_ACCESS_TOKEN",
    "RUNX_CONNECT_BASE_URL",
    "RUNX_CONNECT_OPEN_COMMAND",
    "RUNX_CONNECT_POLL_INTERVAL_MS",
    "RUNX_CONNECT_TIMEOUT_MS",
    "ConnectClient",
    "ConnectOpener",
    "HttpConnectGrant",
    "HttpConnectListResponse",
    "HttpConnectPreprovisionRequest",
    "HttpConnectReadyResponse",
    "HttpConnectRevokeResponse",
    "connection_id",
    "RunxPrivateBoundarySentinel"
  ],
  "allowlist": [
    {
      "path": "crates/runx-runtime/tests/license_boundary.rs",
      "identifier": "RunxPrivateBoundarySentinel",
      "rationale": "Boundary guard negative-case assertion for a copied excluded fixture."
    }
  ],
  "exclude_globs": [
    "crates/target/**",
    "crates/runx-runtime/tests/fixtures/license_boundary/**",
    "dist/**",
    "fixtures/**/*.json",
    "fixtures/**/*.yaml",
    "fixtures/**/*.yml",
    "target/**"
  ],
  "private_move_or_abstract": [
    {
      "path": "crates/runx-runtime/src/connect/client.rs",
      "decision": "move-private",
      "removed": true,
      "rationale": "Hosted OAuth polling and RUNX_CONNECT_ACCESS_TOKEN brokerage."
    },
    {
      "path": "crates/runx-runtime/src/connect/types.rs",
      "decision": "abstract-or-move",
      "removed": true,
      "rationale": "Provider gateway OAuth state and connection_id typed surfaces."
    },
    {
      "path": "crates/runx-runtime/src/connect/opener.rs",
      "decision": "move-private",
      "removed": true,
      "rationale": "Browser opener for hosted connect flow."
    },
    {
      "path": "crates/runx-runtime/src/connect.rs",
      "decision": "rewrite-or-remove",
      "removed": true,
      "rationale": "Module root currently re-exports hosted brokerage."
    },
    {
      "path": "crates/runx-runtime/src/lib.rs",
      "decision": "rewrite",
      "rationale": "Public hosted connect re-exports must be removed or replaced."
    },
    {
      "path": "crates/runx-cli/src/connect.rs",
      "decision": "delete-or-stub",
      "removed": true,
      "rationale": "Native runx connect brokerage command does not belong in OSS."
    },
    {
      "path": "crates/runx-cli/src/main.rs",
      "decision": "rewrite",
      "rationale": "Connect command routing must not invoke hosted brokerage."
    },
    {
      "path": "crates/runx-sdk/src/client.rs",
      "decision": "abstract-or-remove",
      "rationale": "SDK connect-list and connection_id surface is hosted-private."
    }
  ],
  "cloud_private_context": [
    "../cloud/packages/auth/src/hosted-provider-credential.private.ts",
    "../cloud/packages/auth/src/connect.ts",
    "../cloud/packages/auth/src/http.ts",
    "../cloud/packages/auth/src/grant-revocation.ts",
    "../cloud/packages/auth/src/byo-verification.ts",
    "../cloud/packages/api/src/server-connect-routing.ts",
    "../cloud/packages/api/src/public-integrations.ts",
    "../cloud/packages/worker/src/index.ts"
  ]
}
