Manoj Bajaj 3610a69584 refactor: enforce module boundaries — registry impls to server/, AuthService to server/ ...

Phases A–I of TODOS.md:

- Move all five registry classes (IdentityRegistry, PrincipalRegistry,
  VaultRegistry, IdentityClaimRegistry, PrincipalVaultBindingRegistry) from
  identity/ to server/registries.py. Domain model types stay in identity/.

- Break identity/local.py → cli/ coupling: inline _read/_write_active_identity_handle
  helpers so identity/ imports nothing from cli/.

- Remove VaultRegistry + get_server_home imports from auth/service.py; refactor
  revoke() to accept explicit vault_ids from the server layer.

- Move proxy_routes() and _build_route_entry() out of AuthService into
  server/proxy_catalog.py; proxy route delegates to build_proxy_routes().

- Move AuthService from auth/service.py to server/credential_service.py so
  auth/ becomes a true leaf (no vault/, audit/, or server/ imports). Update
  all 10+ import sites in server/, cli/ test files, and the top-level __init__.

- Remove global AuthService(identity="server") from app.py. Refactor /ready
  to resolve the local identity at request time and use app.state.vault directly.

- Remove vault.home property from Vault; replace all callers with store.home.

- Update AGENTS.md architecture table to reflect new file locations.

All 293 tests pass. ruff and ty clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 5c8526a4e7d2

2026-05-20 20:46:17 +05:30

..

__init__.py

feat!: v0.2.0 — Vault + AuthLayer architecture, InputProvider, FlowResult

2026-04-26 13:15:05 +05:30

test_proxy.py

refactor: enforce module boundaries — registry impls to server/, AuthService to server/

2026-05-20 20:46:17 +05:30