refactor(host): detach the AQE router, hook audit and lifecycle from the admitted-host overlay (P0-04, part 2 of 3)

[pacphi]

Summary

Pull request B of three for #324 (P0-04, epic #295, release 4.0.0-beta.1). After A closed the door, B detaches the three remaining built-in consumers of the admitted-host overlay (the AQE router and providers, the hook audit, and the lifecycle loops), so pull request C can delete the adapter cluster without editing a built-in file. Claude Code, Codex and OpenCode behave as before. #324 closes when C merges.

Old to new

Surface	Before	After
ak x host	AQE section header names external providers; credentials list can show an "admitted" row	Header reads "credentials read from env"; the 11 built-in providers only
ak verify	"external AQE" rows	None
ak sync	Writes, prunes and reports externalProviders, activations and receipts	Does not touch them (see D3)
ak x host pick --aqe-provider <not built in>	Same message	Unchanged: unknown aqe provider '...' plus the built-in list (now has a test)
ak audit hooks --host external, ak heal hooks --host external, ak audit context --host external	Audited the adapter manifests	Exit 2: unknown --host value(s): external
ak audit hooks --json	reports.external, and external in hosts and runtimeVersions	Absent
ak audit context default (all)	4 hosts	3 hosts (summary.hosts 4 to 3, unsupportedHosts 1 to 0)
ak status	"external lifecycle host, enabled" row	None
kit.json hostAdapters	Default [], read by admission	Retired key: kept on disk, never read, no "not recognized" warning

Decisions (approved 2026-10-07)

• D1. B detaches consumers only. The three admitted-builder functions in lifecycle-registry.mjs stay, because admission.mjs still imports registerAdmittedLifecycle; C deletes them with it.
• D2. Option a: ak audit hooks loads the kit config only for --host all, so OpenCode ownership is unchanged. The review found ak audit context had stopped passing the config (it expanded all first); fixed, with a test.
• D3. B drops all external receipt code. One behavior change for a project with leftover external data: on main (after A), ak sync pruned stale external declarations, activations and receipts from .agentic-qe/llm-config.json; after B it leaves them byte-identical. What AQE does with a stale externalProviders entry is not verified.
• D5. ADR-0041 is not touched; C reads all adapter ADRs in one pass.

Off-plan edits

• src/lib/hook-audit/agentic-dependency-constraints.json: the retired agentic-qe#628 watch entry no longer lists src/lib/providers.mjs, because the comment that cited #628 went with the version gate (upstream-watch-registry.test.mjs requires every named file to cite its thread).
• docs/proposals/v5-planning-sources.md keeps its Hook audit | external.mjs row: it points into the tag, and the rows for files A deleted also stay. C owns that file.
• 'adapter-declared' removed from the provenance vocabulary in context-audit.mjs and context-budget.mjs (no producer remained), as the plan allowed.

Review

A fresh whole-branch review (most capable model, read-only, with CLI probes against a copy of main) found 0 Critical, 1 Important, 6 Minor. Fixed: the explicit-provider default line had no test (now pinned; mutation fails it); ak audit context config loading; a test that rewrites the router and checks external keys survive; stale comments and fixtures; adapter-declared. Not changed: a comment in docs/plans/2026-10-01-prereq-maintenance-hook-scope.md still names the removed source kind.

Verification

• typecheck, lint and lint:cc (0 errors), lint:md, lint:links:internal (0 errors), build, docs-layout: pass.
• node scripts/run-tests.mjs unit: 6465 tests, 6457 pass, 0 fail, 8 skipped; coverage 94.29% line, 84.08% branch, 93.34% function.
• Mutation checks (each fails its test, then reverted): fallback retirement (3 mutations), explicit-provider default, external-key survival, audit config loading (3), OpenCode ownership, uninstall gate, retired key, context-audit host list.
• Not run: test:ui, any Windows run, a replay of the edit scripts into a second worktree.
• Not verified: AQE's handling of stale externalProviders entries; propagation of the edited claude/providers-reference.md block into a user's ~/.claude/CLAUDE.md on the next ak sync.

🤖 Generated with Claude Code