CAC-264: Finish Go package ownership boundaries

[fredericsun]

Summary

Complete the Go package ownership-boundary refactor described in
docs/design/repository-boundaries.md.

This PR:

• Narrows pkg/adapters/runtime to the supported core adapter interfaces and
  registry contracts. Built-in subscriber, kernel-check, and runtime-specific
  implementation details are now privately owned.
• Moves generated protobuf and gRPC bindings from pkg/server/proto/... to
  gen/inferencecache/v1alpha1.
• Extracts the private controller/server /snapshot JSON contract into
  internal/controlplaneapi, separate from mutable index domain types.
• Internalizes repository-owned implementations:
  • pkg/index → internal/index
  • pkg/server → internal/server
  • pkg/adapters/engine → internal/subscriber
  • pkg/cli/doctor → internal/cli/doctor
  • pkg/testing → internal/testutil
  • pkg/version → internal/version
• Establishes pkg/engineclient as the focused public engine-client boundary
  and moves reference-stack canary behavior to internal/canary.
• Keeps pkg/render reserved without introducing a speculative public API.
• Adds lightweight repository-boundary tests to prevent ownership regressions.
• Updates imports, generation rules, CI configuration, tests, and documentation
  for the new package layout.

The protobuf package, service names, field numbers, and wire behavior remain
unchanged. The /snapshot JSON contract is also preserved, including the
deprecated zero-valued memoryUsed key. HTTP routes, gRPC methods, metrics,
TLS, authentication, CLI behavior, subscriber behavior, and cache-index
behavior are not intentionally changed.

This does intentionally change several Go import paths and reduce the exposed
Go API surface. No forwarding packages are retained because the project has
not been formally deployed.

Local make ci passed, including formatting, vet, lint, Prometheus validation,
documentation synchronization, race-enabled Go tests, and production binary
builds. Optional golden-vector verification was skipped because the local
Python environment does not have xxhash.

Linked issues

CAC-264

Checklist

Vendor-neutral naming (required — see CONTRIBUTING.md)

• No oci / oracle / *.oci.com / oraclecloud.com in any API group, CRD group, proto package, gRPC service/package, Kubernetes namespace, image registry, Helm chart, or Go module path.
• Any cloud-specific (incl. OCI) integration lives in an isolated, optional adapter (pkg/adapters/.../) — never in core controllers, CRD types, the proto contract, or default config.
• No Oracle/OCI domain or namespace in sample manifests, README, or default values.
• Pre-commit naming guard passed (make install-hooks once, then it runs on every commit).

Quality

• Every human-authored commit includes a matching DCO Signed-off-by: trailer (git commit --signoff).
• make reuse-lint passes (SPDX headers and licensing metadata are complete).
• make build and make test pass locally.
• make lint clean (gofmt + go vet).
• make manifests generate produces no drift (generated code committed).
• New/changed behavior has unit tests.
• Operator-facing change (CRD columns/fields, .status, CLI, gRPC/HTTP, install bundle/RBAC, samples)? If so, the install-smoke gate asserts it (see CONTRIBUTING.md).
• CI is green.

Contracts (only if touching CRDs or proto)

• Change matches the tech spec (or the spec is updated in the same PR).
• Backward compatibility considered for v1alpha1 consumers (engines, gateway clients).
• If proto/ changed, docs/design/grpc-contract.md is updated to match (the pre-commit hook enforces this).
• If CRD API types (api/v1alpha1/*_types.go) or the proto contract changed, the documentation is updated to match — the docs site (site/) and/or the design docs (docs/). CI enforces this (make verify-docs-sync); add the no-docs-needed label to waive a genuinely doc-exempt change.

[linear-code]

CAC-264

[github-actions]

Codex review

Files reviewed

• .github/workflows/: .github/workflows/ci.yml [reviewed], .github/workflows/codex-review.yml [reviewed]
• Repository root: CONTRIBUTING.md [reviewed], Makefile [reviewed], README.md [reviewed], REUSE.toml [reviewed]
• api/v1alpha1/: cachepolicy_types.go [reviewed], remaining_crds_types_test.go [reviewed]
• cmd/controller/: main.go [reviewed]
• cmd/inferencecache/: doctor.go [reviewed], main.go [reviewed]
• cmd/kvevent-fake-engine/: e2e_test.go [reviewed], main_test.go [reviewed]
• cmd/kvevent-subscriber/: main.go [reviewed]
• cmd/server/: main.go [reviewed]
• config/observability/: alerting-rules.yaml [reviewed]
• config/server/: server.yaml [reviewed]
• docs/design/: cachebackend-api.md [reviewed], crd-contract.md [reviewed], grpc-contract.md [reviewed], grpc-tls.md [reviewed], kvevent-subscriber-wiring.md [reviewed], lookuproute-ranking.md [reviewed], policy-propagation.md [reviewed], repository-boundaries.md [reviewed]
• docs/observability/: alerts.md [reviewed]
• docs/operations/: index-sizing.md [reviewed]
• docs/: quickstart.md [reviewed]
• docs/reference-stack/: VERSIONS.md [reviewed]
• docs/reference-stack/manifests/sglang-lmcache/: README.md [reviewed], deployment.yaml [reviewed]
• docs/reference-stack/scripts/: canary_dual_input_tokenization.sh [reviewed]
• docs/reference/: metrics.md [reviewed], reason-codes.md [reviewed]
• gen/inferencecache/v1alpha1/: doc.go [skipped — generated], inferencecache.pb.go [skipped — generated], inferencecache_grpc.pb.go [skipped — generated], replica_stats_client_version_test.go [skipped — generated]
• hack/index-sizing/: main.go [reviewed]
• hack/verify-samples/: admission_test.go [reviewed], main.go [reviewed]
• internal/adapters/builtin/: boundaries_test.go [reviewed], registry.go [reviewed], registry_test.go [reviewed]
• internal/adapters/builtin/runtime/: contract_aliases_test.go [reviewed], doc.go [reviewed], lmcachecheck.go [reviewed], lmcachecheck_script_test.go [reviewed], lmcachecheck_test.go [reviewed], sglang_hicache.go [reviewed], sglang_hicache_test.go [reviewed], sglang_lmcache.go [reviewed], sglang_lmcache_test.go [reviewed], subscriber.go [reviewed], vllm_lmcache.go [reviewed], vllm_lmcache_test.go [reviewed], vllm_lmcache_wire.go [reviewed], vllm_lmcache_wire_test.go [reviewed]
• internal/boundarytest/: repository_test.go [reviewed]
• internal/canary/: canary.go [reviewed], canary_test.go [reviewed]
• internal/cli/doctor/checks/: cachebackend.go [reviewed], checks.go [reviewed], checks_test.go [reviewed], endpoints.go [reviewed], podaudit.go [reviewed], tenant_policy.go [reviewed]
• internal/cli/doctor/: finding.go [reviewed], finding_test.go [reviewed]
• internal/cli/doctor/output/: human.go [reviewed], json.go [reviewed], output.go [reviewed], output_test.go [reviewed], table.go [reviewed]
• internal/cli/doctor/output/testdata/: human.txt [reviewed], human_color.txt [reviewed], report.json [reviewed], report.table [reviewed]
• internal/controller/: cachebackend_controller.go [reviewed], cachebackend_controller_test.go [reviewed], cachebackend_engine_compat.go [reviewed], cachebackend_engine_compat_test.go [reviewed], cachebackend_kernelcheck.go [reviewed], cachebackend_kernelcheck_integration_test.go [reviewed], cachebackend_kernelcheck_test.go [reviewed], cachebackend_probe_test.go [reviewed], cachebackend_server_restart.go [reviewed], cacheindex_authed_integration_test.go [reviewed], cacheindex_controller.go [reviewed], cacheindex_controller_test.go [reviewed], cacheindex_integration_test.go [reviewed], cachepolicy_affinity_routing_integration_test.go [reviewed], cachepolicy_authed_integration_test.go [reviewed], cachepolicy_eviction_integration_test.go [reviewed], cachepolicy_matched_tokens_floor_integration_test.go [reviewed], cachepolicy_routing_floor_integration_test.go [reviewed], cachepolicy_strategy_integration_test.go [reviewed], contract_coverage_sweep_test.go [reviewed], controlplane_controller_test.go [reviewed], integration_test.go [reviewed], tenant_quota_integration_test.go [reviewed]
• internal/controlplaneapi/: doc.go [reviewed], snapshot.go [reviewed], snapshot_test.go [reviewed]
• internal/enginebinding/: runtime.go [reviewed]
• internal/index/: adapter_partition_test.go [reviewed], affinity_test.go [reviewed], aggregate_test.go [reviewed], diagnostics_test.go [reviewed], distinguishing_power_lookup_test.go [reviewed], distinguishing_power_test.go [reviewed], doc.go [reviewed], index.go [reviewed], index_test.go [reviewed], lfu_eviction_test.go [reviewed], tenant_quota_test.go [reviewed]
• internal/server/auth/: audience.go [reviewed], doc.go [reviewed], integration_test.go [reviewed], middleware.go [reviewed], middleware_test.go [reviewed]
• internal/server/: adapter_partition_test.go [reviewed], affinity_routing_test.go [reviewed], diagnostics_test.go [reviewed], doc.go [reviewed], inferencecache_service.go [reviewed], lfu_credit_test.go [reviewed], lmcache_offload_integration_test.go [reviewed], logging.go [reviewed], logging_test.go [reviewed], matched_tokens_floor_test.go [reviewed], metrics.go [reviewed], metrics_test.go [reviewed], policy.go [reviewed], policy_test.go [reviewed], probe.go [reviewed], probe_test.go [reviewed], route_dual_input_test.go [reviewed], route_lookup_hitmiss_test.go [reviewed], routing_floor_response_test.go [reviewed], routing_floor_score_test.go [reviewed], server.go [reviewed], server_test.go [reviewed], snapshot.go [reviewed], snapshot_test.go [reviewed], tenant_quota_test.go [reviewed], tls.go [reviewed], tls_test.go [reviewed]
• internal/subscriber/: config.go [reviewed], coverage_test.go [reviewed], doc.go [reviewed], events.go [reviewed], events_test.go [reviewed], forwarder.go [reviewed], forwarder_test.go [reviewed], lora_adapter_test.go [reviewed], mapper.go [reviewed], mapper_test.go [reviewed], metrics_scraper.go [reviewed], metrics_scraper_test.go [reviewed], positional.go [reviewed], positional_test.go [reviewed], sglang_wire_test.go [reviewed], stats_reporter.go [reviewed], stats_reporter_test.go [reviewed], subscriber.go [reviewed], subscriber_test.go [reviewed], wire_test.go [reviewed]
• internal/subscriber/testdata/: vllm_metrics_cpu.txt [reviewed], vllm_metrics_cpu_tick2.txt [reviewed], vllm_metrics_gpu.txt [reviewed], vllm_metrics_legacy_cpu.txt [reviewed], vllm_metrics_multimodel.txt [reviewed], vllm_metrics_openmetrics.txt [reviewed], vllm_metrics_openmetrics_tick2.txt [reviewed], vllm_metrics_partial.txt [reviewed], vllm_metrics_t2.txt [reviewed]
• internal/testutil/: doc.go [reviewed], envtest_setup.go [reviewed]
• internal/version/: doc.go [reviewed], version.go [reviewed]
• internal/webhook/pod/: envtest_integration_test.go [reviewed], podinjector.go [reviewed], podinjector_test.go [reviewed]
• internal/webhook/v1alpha1/: cachebackend_webhook.go [reviewed], cachebackend_webhook_test.go [reviewed]
• pkg/adapters/backend/: endpoint.go [reviewed]
• pkg/adapters/engineclient/: canary.go [reviewed], canary_test.go [reviewed], engineclient.go [reviewed], grpc.go [reviewed], openai.go [reviewed], openai_test.go [reviewed]
• pkg/adapters/engine/: config.go [reviewed], coverage_test.go [reviewed], doc.go [reviewed], events.go [reviewed], events_test.go [reviewed], forwarder.go [reviewed], forwarder_test.go [reviewed], lora_adapter_test.go [reviewed], mapper.go [reviewed], mapper_test.go [reviewed], metrics_scraper.go [reviewed], metrics_scraper_test.go [reviewed], positional.go [reviewed], positional_test.go [reviewed], sglang_wire_test.go [reviewed], stats_reporter.go [reviewed], stats_reporter_test.go [reviewed], subscriber.go [reviewed], subscriber_test.go [reviewed], wire_test.go [reviewed]
• pkg/adapters/engine/testdata/: vllm_metrics_cpu.txt [reviewed], vllm_metrics_cpu_tick2.txt [reviewed], vllm_metrics_gpu.txt [reviewed], vllm_metrics_legacy_cpu.txt [reviewed], vllm_metrics_multimodel.txt [reviewed], vllm_metrics_openmetrics.txt [reviewed], vllm_metrics_openmetrics_tick2.txt [reviewed], vllm_metrics_partial.txt [reviewed], vllm_metrics_t2.txt [reviewed]
• pkg/adapters/runtime/: adapter.go [reviewed], kernelcheck.go [reviewed], kvevent_subscriber.go [reviewed], lmcache_shared.go [reviewed], reference.go [reviewed], reference_test.go [reviewed], wire_contract.go [reviewed]
• pkg/cli/doctor/checks/: cachebackend.go [reviewed], checks.go [reviewed], checks_test.go [reviewed], endpoints.go [reviewed], podaudit.go [reviewed], tenant_policy.go [reviewed]
• pkg/cli/doctor/: finding.go [reviewed], finding_test.go [reviewed]
• pkg/cli/doctor/output/: human.go [reviewed], json.go [reviewed], output.go [reviewed], output_test.go [reviewed], table.go [reviewed]
• pkg/cli/doctor/output/testdata/: human.txt [reviewed], human_color.txt [reviewed], report.json [reviewed], report.table [reviewed]
• pkg/engineclient/: engineclient.go [reviewed], openai.go [reviewed], openai_test.go [reviewed]
• pkg/fingerprint/: chain.go [reviewed]
• pkg/index/: adapter_partition_test.go [reviewed], affinity_test.go [reviewed], aggregate_test.go [reviewed], diagnostics_test.go [reviewed], distinguishing_power_lookup_test.go [reviewed], distinguishing_power_test.go [reviewed], doc.go [reviewed], index.go [reviewed], index_test.go [reviewed], lfu_eviction_test.go [reviewed], snapshot_wire_contract_test.go [reviewed], tenant_quota_test.go [reviewed]
• pkg/render/: doc.go [reviewed]
• pkg/server/auth/: audience.go [reviewed], doc.go [reviewed], integration_test.go [reviewed], middleware.go [reviewed], middleware_test.go [reviewed]
• pkg/server/: adapter_partition_test.go [reviewed], affinity_routing_test.go [reviewed], diagnostics_test.go [reviewed], doc.go [reviewed], inferencecache_service.go [reviewed], lfu_credit_test.go [reviewed], lmcache_offload_integration_test.go [reviewed], logging.go [reviewed], logging_test.go [reviewed], matched_tokens_floor_test.go [reviewed], metrics.go [reviewed], metrics_test.go [reviewed], policy.go [reviewed], policy_test.go [reviewed], probe.go [reviewed], probe_test.go [reviewed], route_dual_input_test.go [reviewed], route_lookup_hitmiss_test.go [reviewed], routing_floor_response_test.go [reviewed], routing_floor_score_test.go [reviewed], server.go [reviewed], server_test.go [reviewed], tenant_quota_test.go [reviewed], tls.go [reviewed], tls_test.go [reviewed]
• pkg/server/proto/inferencecache/v1alpha1/: doc.go [reviewed], inferencecache.pb.go [reviewed], inferencecache_grpc.pb.go [reviewed], replica_stats_client_version_test.go [reviewed]
• pkg/testing/: doc.go [reviewed], envtest_setup.go [reviewed]
• pkg/version/: doc.go [reviewed], version.go [reviewed]
• proto/inferencecache/v1alpha1/: inferencecache.proto [reviewed]
• site/content/en/docs/administration/: troubleshooting.md [reviewed]
• site/content/en/docs/concepts/: architecture.md [reviewed]
• site/content/en/docs/developer-guide/: _index.md [reviewed]

Findings

Blocking

None.

Should-fix

None.

Nit

None.

Per-category coverage

1. Vendor-neutral naming: Clean
2. Contract & spec / docs sync: Clean
3. gRPC fail-open semantics: Clean
4. Quality (tests / error wrapping / package placement / generated drift): Clean

Verdict

approve

[codecov]

Codecov Report

❌ Patch coverage is 96.12069% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/server/inferencecache_service.go	50.00%	4 Missing ⚠️
internal/controller/cacheindex_controller.go	84.61%	2 Missing ⚠️
internal/adapters/builtin/runtime/lmcachecheck.go	93.33%	1 Missing ⚠️
internal/controller/cachebackend_kernelcheck.go	85.71%	0 Missing and 1 partial ⚠️
internal/server/server.go	50.00%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

Codex review

Files reviewed

• .github/workflows: ci.yml, codex-review.yml [reviewed]
• Root: CONTRIBUTING.md, Makefile, README.md, REUSE.toml, buf.yaml [reviewed]
• api/v1alpha1: cachepolicy_types.go, remaining_crds_types_test.go [reviewed]
• cmd/controller: main.go [reviewed]
• cmd/inferencecache: doctor.go, main.go [reviewed]
• cmd/kvevent-fake-engine: e2e_test.go, main_test.go [reviewed]
• cmd/kvevent-subscriber: main.go [reviewed]
• cmd/server: main.go [reviewed]
• config/observability: alerting-rules.yaml [reviewed]
• config/server: server.yaml [reviewed]
• docs/design: cachebackend-api.md, crd-contract.md, grpc-contract.md, grpc-tls.md, kvevent-subscriber-wiring.md, lookuproute-ranking.md, policy-propagation.md, repository-boundaries.md [reviewed]
• docs/observability: alerts.md [reviewed]
• docs/operations: index-sizing.md [reviewed]
• docs: quickstart.md [reviewed]
• docs/reference-stack: VERSIONS.md [reviewed]
• docs/reference-stack/manifests/sglang-lmcache: README.md, deployment.yaml [reviewed]
• docs/reference-stack/scripts: canary_dual_input_tokenization.sh [reviewed]
• docs/reference: metrics.md, reason-codes.md [reviewed]
• gen/inferencecache/v1alpha1: doc.go, inferencecache.pb.go, inferencecache_grpc.pb.go, replica_stats_client_version_test.go [skipped — generated]
• hack/index-sizing: main.go [reviewed]
• hack/verify-samples: admission_test.go, main.go [reviewed]
• internal/adapters/builtin: boundaries_test.go (deleted), registry.go, registry_test.go [reviewed]
• internal/adapters/builtin/runtime: contract_aliases_test.go (deleted), doc.go, lmcachecheck.go, lmcachecheck_script_test.go, lmcachecheck_test.go, sglang_hicache.go, sglang_hicache_test.go, sglang_lmcache.go, sglang_lmcache_test.go, subscriber.go, vllm_lmcache.go, vllm_lmcache_test.go, vllm_lmcache_wire.go, vllm_lmcache_wire_test.go [reviewed]
• internal/boundarytest: repository_test.go [reviewed]
• internal/canary: canary.go, canary_test.go [reviewed]
• internal/cli/doctor/checks: cachebackend.go, checks.go, checks_test.go, endpoints.go, podaudit.go, tenant_policy.go [reviewed]
• internal/cli/doctor: finding.go, finding_test.go [reviewed]
• internal/cli/doctor/output: human.go, json.go, output.go, output_test.go, table.go [reviewed]
• internal/cli/doctor/output/testdata: human.txt, human_color.txt, report.json, report.table [reviewed]
• internal/controller: cachebackend_controller.go, cachebackend_controller_test.go, cachebackend_engine_compat.go, cachebackend_engine_compat_test.go, cachebackend_kernelcheck.go, cachebackend_kernelcheck_integration_test.go, cachebackend_kernelcheck_test.go, cachebackend_probe_test.go, cachebackend_server_restart.go, cacheindex_authed_integration_test.go, cacheindex_controller.go, cacheindex_controller_test.go, cacheindex_integration_test.go, cachepolicy_affinity_routing_integration_test.go, cachepolicy_authed_integration_test.go, cachepolicy_eviction_integration_test.go, cachepolicy_matched_tokens_floor_integration_test.go, cachepolicy_routing_floor_integration_test.go, cachepolicy_strategy_integration_test.go, contract_coverage_sweep_test.go, controlplane_controller_test.go, integration_test.go, tenant_quota_integration_test.go [reviewed]
• internal/controlplaneapi: doc.go, snapshot.go, snapshot_test.go [reviewed]
• internal/enginebinding: runtime.go [reviewed]
• internal/index: adapter_partition_test.go, affinity_test.go, aggregate_test.go, diagnostics_test.go, distinguishing_power_lookup_test.go, distinguishing_power_test.go, doc.go, index.go, index_test.go, lfu_eviction_test.go, tenant_quota_test.go [reviewed]
• internal/server/auth: audience.go, doc.go, integration_test.go, middleware.go, middleware_test.go [reviewed]
• internal/server: adapter_partition_test.go, affinity_routing_test.go, diagnostics_test.go, doc.go, inferencecache_service.go, lfu_credit_test.go, lmcache_offload_integration_test.go, logging.go, logging_test.go, matched_tokens_floor_test.go, metrics.go, metrics_test.go, policy.go, policy_test.go, probe.go, probe_test.go, route_dual_input_test.go, route_lookup_hitmiss_test.go, routing_floor_response_test.go, routing_floor_score_test.go, server.go, server_test.go, snapshot.go, snapshot_test.go, tenant_quota_test.go, tls.go, tls_test.go [reviewed]
• internal/subscriber: config.go, coverage_test.go, doc.go, events.go, events_test.go, forwarder.go, forwarder_test.go, lora_adapter_test.go, mapper.go, mapper_test.go, metrics_scraper.go, metrics_scraper_test.go, positional.go, positional_test.go, sglang_wire_test.go, stats_reporter.go, stats_reporter_test.go, subscriber.go, subscriber_test.go, wire_test.go [reviewed]
• internal/subscriber/testdata: vllm_metrics_cpu.txt, vllm_metrics_cpu_tick2.txt, vllm_metrics_gpu.txt, vllm_metrics_legacy_cpu.txt, vllm_metrics_multimodel.txt, vllm_metrics_openmetrics.txt, vllm_metrics_openmetrics_tick2.txt, vllm_metrics_partial.txt, vllm_metrics_t2.txt [reviewed]
• internal/testutil: doc.go, envtest_setup.go [reviewed]
• internal/version: doc.go, version.go [reviewed]
• internal/webhook/pod: envtest_integration_test.go, podinjector.go, podinjector_test.go [reviewed]
• internal/webhook/v1alpha1: cachebackend_webhook.go, cachebackend_webhook_test.go [reviewed]
• pkg/adapters/backend: endpoint.go [reviewed]
• pkg/adapters/engineclient: canary.go, canary_test.go, engineclient.go, grpc.go, openai.go, openai_test.go (moved/deleted) [reviewed]
• pkg/adapters/engine: config.go, coverage_test.go, doc.go, events.go, events_test.go, forwarder.go, forwarder_test.go, lora_adapter_test.go, mapper.go, mapper_test.go, metrics_scraper.go, metrics_scraper_test.go, positional.go, positional_test.go, sglang_wire_test.go, stats_reporter.go, stats_reporter_test.go, subscriber.go, subscriber_test.go, wire_test.go, testdata/* (moved) [reviewed]
• pkg/adapters/runtime: adapter.go, kernelcheck.go, kvevent_subscriber.go, lmcache_shared.go, reference.go/reference_test.go, wire_contract.go [reviewed]
• pkg/cli/doctor: checks/*, finding.go, finding_test.go, output/* (moved) [reviewed]
• pkg/engineclient: engineclient.go, openai.go, openai_test.go [reviewed]
• pkg/fingerprint: chain.go [reviewed]
• pkg/index: doc.go and implementation/tests moved to internal/index [reviewed]
• pkg/render: doc.go [reviewed]
• pkg/server: implementation, auth, and tests moved to internal/server [reviewed]
• pkg/server/proto/inferencecache/v1alpha1: generated bindings moved to gen/inferencecache/v1alpha1 [skipped — generated]
• pkg/testing: doc.go, envtest_setup.go [reviewed]
• pkg/version: doc.go, version.go [reviewed]
• proto/inferencecache/v1alpha1: inferencecache.proto [reviewed]
• site/content/en/docs/administration: troubleshooting.md [reviewed]
• site/content/en/docs/concepts: architecture.md [reviewed]
• site/content/en/docs/developer-guide: _index.md [reviewed]

Findings

Blocking

None.

Should-fix

• Makefile:542 — verify-naming no longer scans pkg/ after replacing pkg/server/proto with gen. Public Go package/module-path and user-facing defaults under pkg are explicitly core-identity surfaces, so future prohibited vendor naming there would pass the required guard.

Nit

None.

Per-category coverage

1. Vendor-neutral naming: findings above at: Makefile:542
2. Contract & spec / docs sync: Clean
3. gRPC fail-open semantics: Clean
4. Quality (tests / error wrapping / package placement / generated drift): Clean

Verdict

changes-requested

[github-actions]

Codex review

Files reviewed

• .github/workflows/
  • ci.yml [reviewed]
  • codex-review.yml [reviewed]
• Repository root
  • CONTRIBUTING.md [reviewed]
  • Makefile [reviewed]
  • README.md [reviewed]
  • REUSE.toml [reviewed]
  • buf.yaml [reviewed]
• api/v1alpha1/
  • cachepolicy_types.go [reviewed]
  • remaining_crds_types_test.go [reviewed]
• cmd/controller/
  • main.go [reviewed]
• cmd/inferencecache/
  • doctor.go [reviewed]
  • main.go [reviewed]
• cmd/kvevent-fake-engine/
  • e2e_test.go [reviewed]
  • main_test.go [reviewed]
• cmd/kvevent-subscriber/
  • main.go [reviewed]
• cmd/server/
  • main.go [reviewed]
• config/observability/
  • alerting-rules.yaml [reviewed]
• config/server/
  • server.yaml [reviewed]
• docs/design/
  • cachebackend-api.md [reviewed]
  • crd-contract.md [reviewed]
  • grpc-contract.md [reviewed]
  • grpc-tls.md [reviewed]
  • kvevent-subscriber-wiring.md [reviewed]
  • lookuproute-ranking.md [reviewed]
  • policy-propagation.md [reviewed]
  • repository-boundaries.md [reviewed]
• docs/observability/
  • alerts.md [reviewed]
• docs/operations/
  • index-sizing.md [reviewed]
• docs/
  • quickstart.md [reviewed]
• docs/reference-stack/
  • VERSIONS.md [reviewed]
• docs/reference-stack/manifests/sglang-lmcache/
  • README.md [reviewed]
  • deployment.yaml [reviewed]
• docs/reference-stack/scripts/
  • canary_dual_input_tokenization.sh [reviewed]
• docs/reference/
  • metrics.md [reviewed]
  • reason-codes.md [reviewed]
• gen/inferencecache/v1alpha1/
  • doc.go [skipped — generated]
  • inferencecache.pb.go [skipped — generated]
  • inferencecache_grpc.pb.go [skipped — generated]
  • replica_stats_client_version_test.go [skipped — generated]
• hack/index-sizing/
  • main.go [reviewed]
• hack/verify-samples/
  • admission_test.go [reviewed]
  • main.go [reviewed]
• internal/adapters/builtin/
  • boundaries_test.go [reviewed]
  • registry.go [reviewed]
  • registry_test.go [reviewed]
• internal/adapters/builtin/runtime/
  • contract_aliases_test.go [reviewed]
  • doc.go [reviewed]
  • lmcachecheck.go [reviewed]
  • lmcachecheck_script_test.go [reviewed]
  • lmcachecheck_test.go [reviewed]
  • sglang_hicache.go [reviewed]
  • sglang_hicache_test.go [reviewed]
  • sglang_lmcache.go [reviewed]
  • sglang_lmcache_test.go [reviewed]
  • subscriber.go [reviewed]
  • vllm_lmcache.go [reviewed]
  • vllm_lmcache_test.go [reviewed]
  • vllm_lmcache_wire.go [reviewed]
  • vllm_lmcache_wire_test.go [reviewed]
• internal/boundarytest/
  • repository_test.go [reviewed]
• internal/canary/
  • canary.go [reviewed]
  • canary_test.go [reviewed]
• internal/cli/doctor/checks/
  • cachebackend.go [reviewed]
  • checks.go [reviewed]
  • checks_test.go [reviewed]
  • endpoints.go [reviewed]
  • podaudit.go [reviewed]
  • tenant_policy.go [reviewed]
• internal/cli/doctor/
  • finding.go [reviewed]
  • finding_test.go [reviewed]
• internal/cli/doctor/output/
  • human.go [reviewed]
  • json.go [reviewed]
  • output.go [reviewed]
  • output_test.go [reviewed]
  • table.go [reviewed]
• internal/cli/doctor/output/testdata/
  • human.txt [reviewed]
  • human_color.txt [reviewed]
  • report.json [reviewed]
  • report.table [reviewed]
• internal/controller/
  • cachebackend_controller.go [reviewed]
  • cachebackend_controller_test.go [reviewed]
  • cachebackend_engine_compat.go [reviewed]
  • cachebackend_engine_compat_test.go [reviewed]
  • cachebackend_kernelcheck.go [reviewed]
  • cachebackend_kernelcheck_integration_test.go [reviewed]
  • cachebackend_kernelcheck_test.go [reviewed]
  • cachebackend_probe_test.go [reviewed]
  • cachebackend_server_restart.go [reviewed]
  • cacheindex_authed_integration_test.go [reviewed]
  • cacheindex_controller.go [reviewed]
  • cacheindex_controller_test.go [reviewed]
  • cacheindex_integration_test.go [reviewed]
  • cachepolicy_affinity_routing_integration_test.go [reviewed]
  • cachepolicy_authed_integration_test.go [reviewed]
  • cachepolicy_eviction_integration_test.go [reviewed]
  • cachepolicy_matched_tokens_floor_integration_test.go [reviewed]
  • cachepolicy_routing_floor_integration_test.go [reviewed]
  • cachepolicy_strategy_integration_test.go [reviewed]
  • contract_coverage_sweep_test.go [reviewed]
  • controlplane_controller_test.go [reviewed]
  • integration_test.go [reviewed]
  • tenant_quota_integration_test.go [reviewed]
• internal/controlplaneapi/
  • doc.go [reviewed]
  • snapshot.go [reviewed]
  • snapshot_test.go [reviewed]
• internal/enginebinding/
  • runtime.go [reviewed]
• internal/index/
  • adapter_partition_test.go [reviewed]
  • affinity_test.go [reviewed]
  • aggregate_test.go [reviewed]
  • diagnostics_test.go [reviewed]
  • distinguishing_power_lookup_test.go [reviewed]
  • distinguishing_power_test.go [reviewed]
  • doc.go [reviewed]
  • index.go [reviewed]
  • index_test.go [reviewed]
  • lfu_eviction_test.go [reviewed]
  • tenant_quota_test.go [reviewed]
• internal/server/auth/
  • audience.go [reviewed]
  • doc.go [reviewed]
  • integration_test.go [reviewed]
  • middleware.go [reviewed]
  • middleware_test.go [reviewed]
• internal/server/
  • adapter_partition_test.go [reviewed]
  • affinity_routing_test.go [reviewed]
  • diagnostics_test.go [reviewed]
  • doc.go [reviewed]
  • inferencecache_service.go [reviewed]
  • lfu_credit_test.go [reviewed]
  • lmcache_offload_integration_test.go [reviewed]
  • logging.go [reviewed]
  • logging_test.go [reviewed]
  • matched_tokens_floor_test.go [reviewed]
  • metrics.go [reviewed]
  • metrics_test.go [reviewed]
  • policy.go [reviewed]
  • policy_test.go [reviewed]
  • probe.go [reviewed]
  • probe_test.go [reviewed]
  • route_dual_input_test.go [reviewed]
  • route_lookup_hitmiss_test.go [reviewed]
  • routing_floor_response_test.go [reviewed]
  • routing_floor_score_test.go [reviewed]
  • server.go [reviewed]
  • server_test.go [reviewed]
  • snapshot.go [reviewed]
  • snapshot_test.go [reviewed]
  • tenant_quota_test.go [reviewed]
  • tls.go [reviewed]
  • tls_test.go [reviewed]
• internal/subscriber/
  • config.go [reviewed]
  • coverage_test.go [reviewed]
  • doc.go [reviewed]
  • events.go [reviewed]
  • events_test.go [reviewed]
  • forwarder.go [reviewed]
  • forwarder_test.go [reviewed]
  • lora_adapter_test.go [reviewed]
  • mapper.go [reviewed]
  • mapper_test.go [reviewed]
  • metrics_scraper.go [reviewed]
  • metrics_scraper_test.go [reviewed]
  • positional.go [reviewed]
  • positional_test.go [reviewed]
  • sglang_wire_test.go [reviewed]
  • stats_reporter.go [reviewed]
  • stats_reporter_test.go [reviewed]
  • subscriber.go [reviewed]
  • subscriber_test.go [reviewed]
  • wire_test.go [reviewed]
• internal/subscriber/testdata/
  • vllm_metrics_cpu.txt [reviewed]
  • vllm_metrics_cpu_tick2.txt [reviewed]
  • vllm_metrics_gpu.txt [reviewed]
  • vllm_metrics_legacy_cpu.txt [reviewed]
  • vllm_metrics_multimodel.txt [reviewed]
  • vllm_metrics_openmetrics.txt [reviewed]
  • vllm_metrics_openmetrics_tick2.txt [reviewed]
  • vllm_metrics_partial.txt [reviewed]
  • vllm_metrics_t2.txt [reviewed]
• internal/testutil/
  • doc.go [reviewed]
  • envtest_setup.go [reviewed]
• internal/version/
  • doc.go [reviewed]
  • version.go [reviewed]
• internal/webhook/pod/
  • envtest_integration_test.go [reviewed]
  • podinjector.go [reviewed]
  • podinjector_test.go [reviewed]
• internal/webhook/v1alpha1/
  • cachebackend_webhook.go [reviewed]
  • cachebackend_webhook_test.go [reviewed]
• pkg/adapters/backend/
  • endpoint.go [reviewed]
• pkg/adapters/engineclient/
  • grpc.go [reviewed]
• pkg/adapters/runtime/
  • adapter.go [reviewed]
  • kvevent_subscriber.go [reviewed]
  • lmcache_shared.go [reviewed]
  • reference_test.go [reviewed]
• pkg/engineclient/
  • engineclient.go [reviewed]
  • openai.go [reviewed]
  • openai_test.go [reviewed]
• pkg/fingerprint/
  • chain.go [reviewed]
• pkg/index/
  • doc.go [reviewed]
• pkg/render/
  • doc.go [reviewed]
• pkg/testing/
  • doc.go [reviewed]
• proto/inferencecache/v1alpha1/
  • inferencecache.proto [reviewed]
• site/content/en/docs/administration/
  • troubleshooting.md [reviewed]
• site/content/en/docs/concepts/
  • architecture.md [reviewed]
• site/content/en/docs/developer-guide/
  • _index.md [reviewed]

Findings

Blocking

None.

Should-fix

None.

Nit

None.

Per-category coverage

1. Vendor-neutral naming: Clean
2. Contract & spec / docs sync: Clean
3. gRPC fail-open semantics: Clean
4. Quality (tests / error wrapping / package placement / generated drift): Clean

Verdict

approve