The configuration parity tests are retired after N-2 #935

Problem

When the ports under #321 have landed, the shell fallbacks they left behind are dead weight once the N-2 compatibility window allows removing them. Several ports defer their fallback removal to this area's own after-N-2 deletion, which is this issue: #762 (confirmation and delegation), #763 (trusted policy and prompt), #769 (snapshots and stamps), #771 (reviewer execution), #764 (landed-commit verification) and #770 (bounds, lint selection, configuration digest and reporting). (gates.py is deleted by #713.)

Almost every one of those fallbacks lives on a protected path. .agents/agent-skills.conf at origin/main puts packages/agents/source/lib/lib.sh on the golden, owner and constitutional lists, packages/agents/source/lib/agent.sh on the golden and owner lists and packages/agents/source/lib/signing.sh on the constitutional list, with their generated copies. The inventory at baseline fd7b680: policy at lib.sh:292, snapshots at :523, review execution at :546, confirmation and delegation at :742, the GitHub helpers at :812, :830 and :875, and the sourcing of agent.sh and signing.sh at :900 and :902 are in lib.sh; the repository configuration bridge and the owner-review default are in agent.sh; the signing and sign-off fallbacks are in signing.sh. None of these is removed here. The first cutover under #588 deletes lib.sh whole, so every fallback and implementation still in it goes with it, and the second cutover deletes agent.sh and signing.sh.

The measured residual outside protected files is small. The skill scripts that call these ports (for example dt_confirm at commit.sh:179, squash-merge.sh:252 and publish.sh:80) are transaction scripts whose ports (#322 to #327) remove their own call sites, and the one non-transaction fallback branch, packages/agents/source/skills/rebase/shared/scripts/marker-scan.sh:6 (53 code lines), belongs to #333 and #544. What remains for this issue is the configuration parity test and the frozen shell reader it runs as its independent oracle: internal/config/parity_test.go (291 code lines, with the two lib.sh loads at :85 and :283 and the execution of the frozen reader at :79, selected at :131) and internal/config/testdata/legacy-config.sh (83 code lines), 374 code lines in all. Neither can stay once lib.sh is deleted, because the oracle reads the same shell behavior, and neither is on any owner list. The ledger and the migration-note floor complete the issue.

Part of #588 and #321. Retires the configuration parity test and its independent frozen shell reader, builds the ledger that hands every protected fallback to a cutover, and raises the documented minimum version.

Acceptance criteria

1. AC1: Given the repository after the change, then internal/config/parity_test.go and internal/config/testdata/legacy-config.sh are gone, no file under internal/config/ and no caller of the configuration reader loads or runs lib.sh, agent.sh, signing.sh, any generated copy of them or the frozen reader, the Go-only cases that needed no shell oracle still run, and mise run check passes. Tests of the transaction areas and the generator fixtures and assertions are outside this criterion.
2. AC2: Given the ledger of the listed ports' fallbacks, when it is read, then each fallback is marked removed here (the parity oracle), owned by another named issue (marker-scan.sh by Ship the Go binaries as release assets installed through mise's github backend #333 and feat(distribution): migrate consumer tool pins to release assets #544, gates.py by Port the gate runner and pass cache from Python to Go #713), or handed to a cutover with its file and line: every fallback in lib.sh (policy :292, snapshots :523, review execution :546, confirmation :742, helpers :812, :830, :875, and the sourcing at :900 and :902) to the first cutover, every fallback in agent.sh and signing.sh to the second; and none is unaccounted for.
3. AC3: Given the same fixtures, when the configuration reads that the parity oracle covered run before and after through the Go reader, then the values and precedence match the frozen shell readers' results recorded before the removal.
4. AC4: Given machine-only settings (reviewer, delegation check, GitHub login, sign-off identity) set in the repository configuration, when each workflow that reads them runs through its generated entry point, then they are refused or ignored and the machine value decides.
5. AC5: Given the documented minimum version, when the migration note is read, then it names the first release that carries every subcommand the wrappers need, the supported-version window, and evidence that the warning period required by docs/compatibility.md has elapsed for that release, and the window excludes any binary without those subcommands.
6. AC6: Given the diff, then no file on the golden, owner or constitutional path lists is touched, and the pull request needs no owner review.
7. AC7: Non-functional: the Go tests for the library packages pass on Linux, macOS and Windows in CI, and tokens and the lock file are refreshed.
8. AC8: Given the repository after the change, when it is searched for an invocation of the frozen shell configuration reader (a bash or sh execution of a legacy-config script from any Go test), then none is found, so no shell oracle runs in the Go test suite.

Scope and non-goals

Scope: retiring internal/config/parity_test.go and its independent oracle internal/config/testdata/legacy-config.sh, the ledger of every fallback of the listed ports with its handoffs, and the migration-note floor.

Non-goal: agent.sh, signing.sh, lib.sh and their generated copies, and every fallback in them, which the two cutover issues under #588 own. Non-goal: the transaction scripts and their call sites, which the ports #322 to #327 own. Non-goal: the Bats retirement, which the two residual retirement children own. Non-goal: tests of the transaction areas (they retire with their later ports) and the generator fixtures and assertions (they stay until the cutovers); the repository-wide absence of test references to the libraries is the cutovers' condition, not this child's. Non-goal: removing a fallback owned by another issue (#713, #333, #544). Non-goal: removing the fallbacks and implementations of #772, #775 and #777 from lib.sh and agent.sh: those outcomes narrow to the port landing, with the deletion handed to the cutovers.

Approach

Meet AC1 to AC8. Record the oracle results on the fixtures first, build the ledger, retire the parity test and the frozen reader, then raise the floor and regenerate. The mechanism is the implementer's choice within those outcomes.

Dependencies

Blocked by: #932 (whose AC6 compares the Go reader with the frozen readers before they are retired here), #933 and #934 (the two residual Bats retirement children), the earlier children in planned order, the existing ports #755, #756, #760, #761, #762, #763, #764, #769, #770, #771 and #713, and #753 (golden-file protection for the Go enforcement paths).

Not blocked by #772, #775 or #777: their removals fall in lib.sh and agent.sh, which are protected files only a cutover deletes, so each of those issues closes when its port has landed and the ledger hands its fallback to the first or second cutover issue under #588. Both cutovers wait for this issue.

Size

S. One pull request: the parity test is 291 code lines and the frozen reader 83 at baseline fd7b680, 374 in all (non-blank, non-comment lines counted with grep; scc is unavailable on this host, so this figure is a count, to be re-measured with the project's measurement at PR time), the ledger and the migration note are prose, so the change stays well under 800 code lines and 2,000 prose lines. The estimate is counted, not promised: the non-owner inventory above is complete at that baseline (the transaction scripts and marker-scan.sh belong to other issues).

Verify plan

• AC1: mise run check passes, neither file exists, and a search limited to internal/config/ and the Go callers of the configuration reader for lib.sh, agent.sh, signing.sh and legacy-config finds none. The search does not cover the transaction suites (tests/skills/) or tests/tools/generate-skills.bats.
• AC2: the ledger, checked against the closed owning issues, the path lists, the baseline line numbers and the diff.
• AC3: the oracle results recorded on the fixtures before the removal compared with the Go reader's afterwards.
• AC4: a Go test that sets each machine-only key in repository configuration and asserts it is not used, plus a workflow run through each generated entry point.
• AC5: the migration note names the floor, the window and the warning-period evidence, and a check compares them with the published releases.
• AC6: the pull request's file list matched against the path lists in .agents/agent-skills.conf, and the merge-policy classifier reporting no golden, owner or constitutional finding.
• AC7: the CI matrix jobs and the token and lock refresh.
• AC8: a search of the Go test sources for legacy-config and for shell execution of a configuration reader finds none, and mise run check passes.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

Retiring the parity test and the frozen reader removes the check that the Go reader agrees with the frozen shell; AC3 records that agreement first. Removing the floor's support for old binaries strands consumers on them. Undo: revert the change, which restores the parity test, the frozen reader and the previous floor.

Operator authority

None.