@voxgig/sdkgen 4.8.2 → 4.8.3

package/project/.sdk/model/feature/secrets.aon

@@ -56,52 +56,154 @@ main: kit: feature: secrets: {
   # All inactive by default, like the feature itself. A project turns on
   # what its chain actually names.
   plugin: {
-    dotenv: {
-      title: 'Read secrets from a .env file or a directory of files'
-      needs: { fs: true }
-      path: [
-        'src/feature/secrets/sekreto/provider/dotenv.ts'
-        'src/feature/secrets/sekreto/provider/file.ts'
-      ]
-    }
+    # NO dotenv/file GROUP. Upstream sekreto made dotenv and file
+    # BUILT-INS (src/provider/builtin.ts imports and instantiates them
+    # unconditionally, and Sekreto.ts imports builtin.ts) — so they ship
+    # with the feature core and CANNOT be a trimmable group: a trimmable
+    # group here would let the trim delete two modules the vendored core
+    # imports, and the SDK would not compile.
+    #
+    # plugins/httpjson.ts is likewise in no group: it is the shared HTTP
+    # helper eight plugins import, so it ships with the feature core.
 
     vault: {
       title: 'HashiCorp Vault and boru'
       needs: { fs: true, fetch: true }
       path: [
-        'src/feature/secrets/sekreto/provider/hashicorp.ts'
-        'src/feature/secrets/sekreto/provider/boru.ts'
+        'src/feature/secrets/sekreto/plugins/hashicorp.ts'
+        'src/feature/secrets/sekreto/plugins/boru.ts'
+        'feature/secrets/plugins/hashicorp/hashicorp.go'
+        'feature/secrets/plugins/boru/boru.go'
+        'feature/secrets/voxgig_sekreto/plugins/hashicorp.py'
+        'feature/secrets/voxgig_sekreto/plugins/boru.py'
       ]
+      def: ts: {
+        hashicorp: 'src/feature/secrets/sekreto/plugins/hashicorp.ts'
+        boru: 'src/feature/secrets/sekreto/plugins/boru.ts'
+      }
+      # go: package-qualified Definition symbols (each plugin is its own
+      # package, and the symbol grammar is the language's own).
+      def: go: {
+        'hashicorp.Plugin': 'feature/secrets/plugins/hashicorp/hashicorp.go'
+        'boru.Plugin': 'feature/secrets/plugins/boru/boru.go'
+      }
+      # py: module paths relative to the SDK package root (Main_py copies
+      # tm/py/pkg INTO <name>_sdk/, so the trim patterns drop the leading
+      # pkg/ while Config_py derives the import module from it).
+      def: py: {
+        hashicorp: 'pkg/feature/secrets/voxgig_sekreto/plugins/hashicorp.py'
+        boru: 'pkg/feature/secrets/voxgig_sekreto/plugins/boru.py'
+      }
     }
 
     cloud: {
       title: 'GCP Secret Manager and Azure Key Vault'
       needs: { fetch: true }
       path: [
-        'src/feature/secrets/sekreto/provider/gcpsecrets.ts'
-        'src/feature/secrets/sekreto/provider/azuresecrets.ts'
+        'src/feature/secrets/sekreto/plugins/gcpsecrets.ts'
+        'src/feature/secrets/sekreto/plugins/azuresecrets.ts'
+        'feature/secrets/plugins/gcpsecrets/gcpsecrets.go'
+        'feature/secrets/plugins/azuresecrets/azuresecrets.go'
+        'feature/secrets/voxgig_sekreto/plugins/gcpsecrets.py'
+        'feature/secrets/voxgig_sekreto/plugins/azuresecrets.py'
       ]
+      def: ts: {
+        gcpsecrets: 'src/feature/secrets/sekreto/plugins/gcpsecrets.ts'
+        azuresecrets: 'src/feature/secrets/sekreto/plugins/azuresecrets.ts'
+      }
+      def: go: {
+        'gcpsecrets.Plugin': 'feature/secrets/plugins/gcpsecrets/gcpsecrets.go'
+        'azuresecrets.Plugin': 'feature/secrets/plugins/azuresecrets/azuresecrets.go'
+      }
+      def: py: {
+        gcpsecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/gcpsecrets.py'
+        azuresecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/azuresecrets.py'
+      }
     }
 
     saas: {
       title: '1Password, Doppler and Infisical'
       needs: { fetch: true }
       path: [
-        'src/feature/secrets/sekreto/provider/onepassword.ts'
-        'src/feature/secrets/sekreto/provider/doppler.ts'
-        'src/feature/secrets/sekreto/provider/infisical.ts'
+        'src/feature/secrets/sekreto/plugins/onepassword.ts'
+        'src/feature/secrets/sekreto/plugins/doppler.ts'
+        'src/feature/secrets/sekreto/plugins/infisical.ts'
+        'feature/secrets/plugins/onepassword/onepassword.go'
+        'feature/secrets/plugins/doppler/doppler.go'
+        'feature/secrets/plugins/infisical/infisical.go'
+        'feature/secrets/voxgig_sekreto/plugins/onepassword.py'
+        'feature/secrets/voxgig_sekreto/plugins/doppler.py'
+        'feature/secrets/voxgig_sekreto/plugins/infisical.py'
       ]
+      def: ts: {
+        onepassword: 'src/feature/secrets/sekreto/plugins/onepassword.ts'
+        doppler: 'src/feature/secrets/sekreto/plugins/doppler.ts'
+        infisical: 'src/feature/secrets/sekreto/plugins/infisical.ts'
+      }
+      def: go: {
+        'onepassword.Plugin': 'feature/secrets/plugins/onepassword/onepassword.go'
+        'doppler.Plugin': 'feature/secrets/plugins/doppler/doppler.go'
+        'infisical.Plugin': 'feature/secrets/plugins/infisical/infisical.go'
+      }
+      def: py: {
+        onepassword: 'pkg/feature/secrets/voxgig_sekreto/plugins/onepassword.py'
+        doppler: 'pkg/feature/secrets/voxgig_sekreto/plugins/doppler.py'
+        infisical: 'pkg/feature/secrets/voxgig_sekreto/plugins/infisical.py'
+      }
     }
 
     # The only plugin that costs node:crypto: AWS request signing.
-    # `Sigv4.ts` goes with it, and goes only with it.
+    # `plugins/sigv4.ts` goes with it, and goes only with it. ONE file,
+    # TWO definitions — Secrets Manager and Parameter Store — which is
+    # exactly why `def` is a map.
     aws: {
       title: 'AWS Secrets Manager and Parameter Store (SigV4 signing)'
       needs: { fetch: true, crypto: true }
       path: [
-        'src/feature/secrets/sekreto/provider/aws.ts'
-        'src/feature/secrets/sekreto/Sigv4.ts'
+        'src/feature/secrets/sekreto/plugins/aws.ts'
+        'src/feature/secrets/sekreto/plugins/sigv4.ts'
+        'feature/secrets/plugins/aws/aws.go'
+        'feature/secrets/plugins/aws/sigv4.go'
+        'feature/secrets/voxgig_sekreto/plugins/aws.py'
+        'feature/secrets/voxgig_sekreto/plugins/sigv4.py'
+      ]
+      def: ts: {
+        awssecrets: 'src/feature/secrets/sekreto/plugins/aws.ts'
+        awsparams: 'src/feature/secrets/sekreto/plugins/aws.ts'
+      }
+      # ONE package, TWO definitions - go's spelling of the ts aws.ts pair.
+      def: go: {
+        'aws.Secrets': 'feature/secrets/plugins/aws/aws.go'
+        'aws.Params': 'feature/secrets/plugins/aws/aws.go'
+      }
+      # ONE module, TWO definitions - py's spelling of the ts aws.ts pair.
+      # plugins/sigv4.py goes with it, and goes only with it.
+      def: py: {
+        awssecrets: 'pkg/feature/secrets/voxgig_sekreto/plugins/aws.py'
+        awsparams: 'pkg/feature/secrets/voxgig_sekreto/plugins/aws.py'
+      }
+    }
+
+    # The only plugin that runs a CHILD PROCESS: the secretspec CLI
+    # bridge. Gated on its own so an SDK never carries spawnSync into a
+    # runtime that would refuse it.
+    secretspec: {
+      title: 'secretspec CLI bridge (child process)'
+      needs: { fs: true }
+      path: [
+        'src/feature/secrets/sekreto/plugins/secretspec.ts'
+        'feature/secrets/plugins/secretspec/secretspec.go'
+        'feature/secrets/voxgig_sekreto/plugins/secretspec.py'
       ]
+      def: ts: {
+        secretspec: 'src/feature/secrets/sekreto/plugins/secretspec.ts'
+      }
+      def: go: {
+        'secretspec.Plugin': 'feature/secrets/plugins/secretspec/secretspec.go'
+      }
+      def: py: {
+        secretspec: 'pkg/feature/secrets/voxgig_sekreto/plugins/secretspec.py'
+      }
     }
   }
 

package/project/.sdk/model/target/c.aon

@@ -8,6 +8,16 @@ main: kit: target: c: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the fused corpus runner, whose engine half is now
+  # the vendored omni runner (tests/vendor/omni) and whose support half
+  # (normalize / deep_equal / brief / null_substitute) is subsumed by
+  # omni_deepequal / omni_matchval / omni_stringify. `doctor` reports
+  # leftovers; `doctor prune` deletes them.
+  superseded: [
+    'tests/runner.h'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/clojure.aon

@@ -12,6 +12,19 @@ main: kit: target: clojure: {
     kind: *'prod' | string
   }
 
+  # RETIREMENT. Nothing is superseded by the omni migration, and the empty
+  # list is the honest answer rather than an oversight: clojure never had a
+  # separate hand-written runner FILE to retire. Its entry loop, matcher and
+  # error handling lived INSIDE test/sdk/test/struct_corpus.clj alongside the
+  # corpus wiring, and that file keeps its name and is rewritten in place, so
+  # regeneration overwrites it and there is nothing for `doctor prune` to
+  # delete. (Contrast go, which retired test/struct_runner_test.go, and lua,
+  # which retired test/struct_runner.lua — both standalone files.)
+  #
+  # test/sdk/test_runner.clj is NOT superseded: despite the name it is the
+  # tools.deps `-M:test` main entry point, not a corpus engine.
+  superseded: []
+
   # struct is vendored under src/voxgig/struct.clj — no external dep.
   # The library itself needs only org.clojure/clojure (declared in deps.edn).
   deps: {

package/project/.sdk/model/target/cpp.aon

@@ -8,6 +8,16 @@ main: kit: target: cpp: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct-corpus runner header
+  # (test/runner_support.hpp is support-only — the file/env loaders,
+  # sdk-test-control skips, make_ctx_from_map/fixctx, entity_list_to_data —
+  # and is RETAINED, name unchanged, because the generated entity suites
+  # include it). `doctor` reports leftovers; `doctor prune` deletes them.
+  superseded: [
+    'test/struct_runner.hpp'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/csharp.aon

@@ -7,6 +7,15 @@ main: kit: target: csharp: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct corpus engine. Runner.cs (class
+  # TestRunner) is support-only and RETAINED, name unchanged so emitted
+  # call sites need no churn; the StructRunner support members live on
+  # inside it. `doctor` reports leftovers; `doctor prune` deletes them.
+  superseded: [
+    'test/StructRunner.cs'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/dart.aon

@@ -7,6 +7,16 @@ main: kit: target: dart: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the fused corpus runner and the second, independent
+  # struct-corpus engine, both replaced by test/omni.dart over the vendored
+  # @voxgig/omni port. `doctor` reports leftovers; `doctor prune` deletes
+  # them (jostraca only ever writes, it cannot delete).
+  superseded: [
+    'test/runner.dart'
+    'test/struct_corpus.dart'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/elixir.aon

@@ -8,6 +8,15 @@ main: kit: target: elixir: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the hand-written corpus engine, replaced by the
+  # vendored @voxgig/omni runner under test/vendor/omni driven through
+  # test/support/omni.ex. `doctor` reports leftovers; `doctor prune` deletes
+  # them.
+  superseded: [
+    'test/support/struct_corpus.ex'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/go.aon

@@ -8,6 +8,19 @@ main: kit: target: go: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/go/feature/secrets/), so
+  # a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): both fused runners. `doctor` reports leftovers;
+  # `doctor prune` deletes them.
+  superseded: [
+    'test/runner_test.go'
+    'test/struct_runner_test.go'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/java.aon

@@ -7,6 +7,15 @@ main: kit: target: java: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct-corpus runner class
+  # (test/RunnerSupport.java is support-only and RETAINED, name unchanged
+  # so emitted call sites need no churn). `doctor` reports leftovers;
+  # `doctor prune` deletes them.
+  superseded: [
+    'test/StructRunner.java'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/js.aon

@@ -7,6 +7,13 @@ main: kit: target: js: {
   module: name: '$$name$$'
   base: 'BASE'
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the single fused runner. `doctor` reports
+  # leftovers; `doctor prune` deletes them.
+  superseded: [
+    'test/runner.js'
+  ]
+
   deps: &: {
     # TODO: fix aontu disjunctions!
     kind: *'prod' | string # 'peer' |'dev'

package/project/.sdk/model/target/kotlin.aon

@@ -7,6 +7,15 @@ main: kit: target: kotlin: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct-corpus runner class
+  # (test/RunnerSupport.kt is support-only and RETAINED, name unchanged
+  # so emitted call sites need no churn). `doctor` reports leftovers;
+  # `doctor prune` deletes them.
+  superseded: [
+    'test/StructRunner.kt'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/lean.aon

@@ -8,6 +8,23 @@ main: kit: target: lean: {
   base: 'BASE'
   srcfeature: false
 
+  # RETIREMENT. Retired by the move to the vendored @voxgig/omni corpus
+  # runner (vendor-tag rollout): NOTHING, deliberately, and the empty list
+  # says so rather than leaving the key off.
+  #
+  # Lean's corpus ENGINE was never a file of its own. It lived FUSED inside
+  # test/StructCorpus.lean (its own JSON reader, fixJson, eqv, matchval,
+  # doMatch, resolveArgs, checkResult, handleError and runSet) and again
+  # inside test/TPrimaryUtility.lean (runset, deepEq, strCheck, matchDeep).
+  # Both files were rewritten IN PLACE onto test/OmniResolver.lean, so both
+  # KEEP THEIR NAMES, the `structcorpus` and `primary` lean_exe roots are
+  # unchanged, and no emitted call site needed churn. test/TFeature.lean is a
+  # hand-written behavioural suite, not a corpus runner, and is RETAINED;
+  # test/Runner.lean (generated) is the entity/pipeline lane, likewise
+  # RETAINED despite the name. There is therefore no whole-file leftover for
+  # `doctor` to report or `doctor prune` to delete.
+  superseded: []
+
   # Entities are generic (config-driven F.makeEntity), so no per-entity or
   # per-feature generated modules — the same model as the Haskell target. The
   # readme + agentguide phases read the API model directly (not per-entity

package/project/.sdk/model/target/lua.aon

@@ -8,6 +8,14 @@ main: kit: target: lua: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct-corpus runner (test/runner.lua is
+  # support-only and RETAINED). `doctor` reports leftovers; `doctor
+  # prune` deletes them.
+  superseded: [
+    'test/struct_runner.lua'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/ocaml.aon

@@ -8,6 +8,15 @@ main: kit: target: ocaml: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the hand-written corpus engine, replaced by
+  # test/omni_resolver.ml over the vendored @voxgig/omni port
+  # (test/vendor/omni/omni.ml). `doctor` reports leftovers; `doctor prune`
+  # deletes them (jostraca only ever writes, it cannot delete).
+  superseded: [
+    'test/corpus_runner.ml'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/perl.aon

@@ -8,6 +8,14 @@ main: kit: target: perl: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct-corpus runner (t/runner.pm is
+  # support-only and RETAINED). `doctor` reports leftovers; `doctor
+  # prune` deletes them.
+  superseded: [
+    't/struct_runner.pm'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/php.aon

@@ -8,6 +8,14 @@ main: kit: target: php: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct-corpus runner (test/Runner.php is
+  # support-only and RETAINED). `doctor` reports leftovers; `doctor
+  # prune` deletes them.
+  superseded: [
+    'test/StructRunner.php'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/py.aon

@@ -8,6 +8,19 @@ main: kit: target: py: {
   base: 'BASE'
   srcfeature: false
 
+  # Applicability (docs/design/feature-tags.md). A vendored sekreto port
+  # lives in this target's feature container (tm/py/pkg/feature/secrets/),
+  # so a feature that resolves secrets through sekreto can apply here.
+  provides: { sekreto: true }
+
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct-corpus runner (test/runner.py is
+  # support-only and RETAINED). `doctor` reports leftovers; `doctor
+  # prune` deletes them.
+  superseded: [
+    'test/struct_runner.py'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/rb.aon

@@ -8,6 +8,14 @@ main: kit: target: rb: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the struct-corpus runner (test/runner.rb is
+  # support-only and RETAINED). `doctor` reports leftovers; `doctor
+  # prune` deletes them.
+  superseded: [
+    'test/struct_runner.rb'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/rust.aon

@@ -8,6 +8,16 @@ main: kit: target: rust: {
   base: 'BASE'
   srcfeature: false
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the hand-written struct corpus runner, superseded
+  # by the vendored @voxgig/omni engine driven through
+  # tests/omni_resolver/mod.rs. `doctor` reports leftovers; `doctor prune`
+  # deletes them. (tests/common/mod.rs is NOT listed: it kept its name and
+  # its support half, and only the corpus engine inside it was retired.)
+  superseded: [
+    'tests/struct_runner/mod.rs'
+  ]
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/scala.aon

@@ -7,14 +7,33 @@ main: kit: target: scala: {
   base: 'BASE'
   srcfeature: false
 
+  # Retired by the move to the vendored @voxgig/omni corpus runner
+  # (vendor-tag rollout): NOTHING, deliberately, and the empty list says so
+  # rather than leaving the key off.
+  #
+  # Scala's corpus ENGINE was never a file of its own. It lived FUSED inside
+  # sdktest/StructCorpus.scala — `object Runner`'s own JSON reader, fixJson,
+  # deep equality, matchval/doMatch, resolveArgs, checkResult, handleError and
+  # runSet — and sdktest/PrimaryCorpus.scala drove the same object. Both files
+  # were rewritten IN PLACE onto sdktest/OmniResolver.scala, so both KEEP
+  # THEIR NAMES, `object Runner` keeps its name (the Makefile still runs
+  # `--main-class Runner`), and no emitted call site needed churn.
+  # sdktest/SdkTestSupport.scala is support-ONLY and is RETAINED, exactly as
+  # java's RunnerSupport.java and csharp's Runner.cs. There is therefore no
+  # whole-file leftover for `doctor` to report or `doctor prune` to delete.
+  superseded: []
+
   deps: &: {
     kind: *'prod' | string
   }
 
   # struct is inlined under utility/struct — no external runtime dep.
   # JSON parsing is the zero-dep utility/Json.java; HTTP transport is
-  # java.net.http.HttpClient (JDK built-in). The corpus runner and pipeline
-  # tests are plain scala-cli mains (no test-framework dependency).
+  # java.net.http.HttpClient (JDK built-in). The corpus ENGINE is the vendored
+  # @voxgig/omni scala port under sdktest/vendor/omni — source, not a
+  # dependency, and scala-cli compiles it with everything else. The corpus
+  # runners, the omni smoke test and the pipeline tests are plain scala-cli
+  # mains (no test-framework dependency).
   deps: {}
 }
 

package/project/.sdk/model/target/swift.aon

@@ -7,6 +7,24 @@ main: kit: target: swift: {
   base: 'BASE'
   srcfeature: false
 
+  # Retired by the move to the vendored @voxgig/omni corpus runner
+  # (vendor-tag rollout): NOTHING, deliberately, and the empty list says so
+  # rather than leaving the key off.
+  #
+  # Swift's corpus ENGINE was never a file of its own. It lived inline in
+  # two places - `SdkRunner.runSet`/`matchDeep` inside
+  # Tests/ProjectNameSDKTests/Runner.swift, and a second, independent
+  # engine (`runset`/`canon`/`fixNull`) private to
+  # Tests/ProjectNameSDKTests/StructUtilityTest.swift. Both were rewritten
+  # IN PLACE onto Tests/ProjectNameSDKTests/OmniResolver.swift, so both
+  # files KEEP THEIR NAMES and every emitted call site needs no churn:
+  # Runner.swift is support-ONLY now (testJsonPath, makeCtxFromMap, fixCtx,
+  # errFromMap, and the deepEqual/matchString/errCode the behavioural
+  # suites use) and is RETAINED, exactly as csharp's Runner.cs and java's
+  # RunnerSupport.java. There is therefore no whole-file leftover for
+  # `doctor` to report or `doctor prune` to delete.
+  superseded: []
+
   deps: &: {
     kind: *'prod' | string
   }

package/project/.sdk/model/target/ts.aon

@@ -12,6 +12,19 @@ main: kit: target: ts: {
   # secrets through sekreto can apply here.
   provides: { sekreto: true }
 
+  # Files earlier toolchains generated that this target has RETIRED
+  # (vendor-tag rollout): the hand-written runner and the omni compat
+  # shim, and the pre-reshape sekreto shapes. `doctor` reports leftovers;
+  # `doctor prune` deletes them.
+  superseded: [
+    'test/runner.ts'
+    'test/vendor/omni/compat.ts'
+    'src/feature/secrets/sekreto/Providers.ts'
+    'src/feature/secrets/sekreto/Sigv4.ts'
+    'src/feature/secrets/sekreto/provider/Registry.ts'
+    'src/feature/secrets/sekreto/provider/http.ts'
+  ]
+
   deps: &: {
     # TODO: fix aontu disjunctions!
     kind: *'prod' | string # 'peer' |'dev'

package/project/.sdk/src/cmp/clojure/Package_clojure.ts

@@ -16,6 +16,13 @@ import type {
 // tools.deps shim used to run the tests supports `-M:alias` reading :paths /
 // :extra-paths / :main-opts, but NOT per-alias :extra-deps, so every dependency
 // lives at the top-level :deps.
+//
+// `test/vendor/omni` is a SECOND test source root, not a subdirectory of the
+// first: the vendored @voxgig/omni port declares `voxgig.omni.runner`, so its
+// namespaces resolve only when the directory holding `voxgig/` is itself on
+// the classpath. Rooting it at `test` instead would demand the namespace
+// `vendor.omni.voxgig.omni.runner`, which the vendored file cannot carry -
+// it is read-only, resynced from upstream.
 const Package = cmp(async function Package(props: any) {
   const ctx$ = props.ctx$
   const model: Model = ctx$.model
@@ -26,10 +33,10 @@ const Package = cmp(async function Package(props: any) {
  :deps {org.clojure/clojure {:mvn/version "1.12.5"}}
  :aliases
  {:test
-  {:extra-paths ["test"]
+  {:extra-paths ["test" "test/vendor/omni"]
    :main-opts ["-m" "sdk.test-runner"]}
   :test-compile
-  {:extra-paths ["test"]
+  {:extra-paths ["test" "test/vendor/omni"]
    :main-opts ["-e" "(require 'sdk.test-runner)(println :ok)"]}}}
 `)
   })

package/project/.sdk/src/cmp/cpp/Gitignore_cpp.ts

@@ -13,6 +13,9 @@ test/*.out
 *.o
 *.out
 
+# Struct-corpus run report (written by test/struct_corpus_test.cpp)
+corpus-scoreboard.json
+
 # IDE / OS
 .idea/
 .vscode/

package/project/.sdk/src/cmp/dart/Test_dart.ts

@@ -39,6 +39,7 @@ import 'dart:io';
 import 'harness.dart' as harness;
 
 import 'exists_test.dart' as exists_test;
+import 'omni_smoke_test.dart' as omni_smoke_test;
 import 'struct_test.dart' as struct_test;
 import 'primary_test.dart' as primary_test;
 import 'pipeline_test.dart' as pipeline_test;
@@ -61,6 +62,7 @@ import 'readme_examples_test.dart' as readme_examples_test;
       Content(`
 Future<void> main() async {
   exists_test.tests();
+  omni_smoke_test.tests();
   struct_test.tests();
   primary_test.tests();
   pipeline_test.tests();

package/project/.sdk/src/cmp/elixir/Package_elixir.ts

@@ -78,7 +78,10 @@ const Package = cmp(async function Package(props: any) {
 
 ${depsBlock}
 
-  defp elixirc_paths(:test), do: ["lib", "test/support"]
+  # test/vendor carries the vendored @voxgig/omni engine the corpus suites
+  # run through; it is a .ex tree, so mix has to be told to compile it, and
+  # only under :test - a consumer's library build never sees the runner.
+  defp elixirc_paths(:test), do: ["lib", "test/support", "test/vendor"]
   defp elixirc_paths(_), do: ["lib"]
 
   defp package do