[TRACKING] One delivery path, one partner boundary — execution checklist (#148) #157

Execution checklist for epic #148. Cross off in order — the sequence is load-bearing, not cosmetic.

The order and why

S1 ──┬──> S2
     ├──> S3 ──> S4 ──┐
     └────────────────┴──> S5 ──┬──> S6
                                └──> S7 ──> S8

S1 first because it removes ~200 lines that every later story would otherwise have to move, read around, or keep working. S5 late because it is the largest diff and benefits most from a smaller tree. S6/S7 after S5 because they document and pin the end state, not an intermediate one.

Checklist

• S1 — Delete the retired delivery path; refuse an incomplete config #149 · S1 — Delete the retired delivery path; refuse an incomplete config
  Closes C-63, [þing-02] P1 — guard or retire the legacy path (unfao.py:560, :571) before 2026-11-30 #145; resolves C-29. Unblocks everything.
• S2 — Retire delivery/identity.py, and record why it went #150 · S2 — Retire delivery/identity.py, and record why
  Closes C-64, C-25. Depends on S1.
• S3 — Collapse the two extraction seams into one #151 · S3 — Collapse the two extraction seams into one
  Closes C-65. Depends on S1.
• S4 — Lookup access hygiene: one read per run, no private-name coupling #152 · S4 — Lookup access hygiene: one read per run, no private-name coupling
  Closes C-66, C-68. Depends on S3.
• S5 — Separate partner declarations from delivery machinery #153 · S5 — Separate partner declarations from delivery machinery
  Closes C-69, C-70. Depends on S1–S4. The clone-enabling change.
• S6 — Correct ADR-012 and the manager CIC to describe what the code is #154 · S6 — Correct ADR-012 and the manager CIC
  Closes C-67. Depends on S5.
• S7 — Prove clone-readiness mechanically #155 · S7 — Prove clone-readiness mechanically
  Depends on S5.
• S8 — Epic closeout: register, ADR record, and issue hygiene #156 · S8 — Closeout: register, ADR record, issue hygiene
  Closes Cluster L. Depends on S6, S7.

Ritual per story

/review-diff → /register-risk if there are findings → address them → /ship-it → PR → CI green → merge → sync development.

Invariants that must hold at every step

1. The wire contract does not change. test_hop_b_sink_e2e.py and test_wire_*.py byte-parity fixtures green throughout. Any moved byte means the story is wrong.
2. All 40+ ADR-013 falsification guards green.
3. views_pipeline_core stays imported by exactly one module. It is one file wide today; no story may spread it.
4. Expect the 5 known local pyarrow byte-parity failures (local 23.0.1 vs pinned 16.1.0) and no new ones — CI is authoritative.

Definition of done for the epic

• One delivery path; an incomplete launch config raises naming the missing key
• unfao/managers/unfao.py < 450 lines (from 636)
• Partner-neutral machinery importable with zero reference to unfao, proven by subprocess test
• Every row of ADR-012's ontology table verifiable by a command
• Register reflects the end state; Cluster L closed
• docs/CLONING.md exists and is short enough to read before cutting a repo

Not in this epic — deliberately

Strategy hierarchy · DeliveryProfile object (C-33/D-09 — awaits #97's real second-partner needs) · shared client library · pipeline-core de-inheritance (C-40's shell — blocked on their 3.0.0) · repo rename (D-12/#96).

Each is an abstraction for a consumer that does not exist yet. WET before DRY — build it when the second partner shows its shape, and defer behind a named trigger.

Out-of-epic dependencies

None. This epic is deliberately free of upstream blocks — everything else open in the register waits on pipeline-core, the 3.0.0 release signal, views-datafactory#387 or faoapi. That is why it can run now.