refactor(harness): delete retired server graph topology (SAP-3091)

[ynadge]

Primary change type

• Bug fix
• Documentation
• Feature
• Tests
• Dependency update
• Maintenance or refactor

Problem and motivation

The retired server graph engine, snapshot store, graph-only inventory/invocation lifecycle and contracts remained as orphaned source after composition removal.

Summary and scope

Delete those modules and their topology-only tests/fixtures. Remove the retired bus contract and filter unsupported events at the browser transport boundary while preserving current event delivery and unsubscribe behavior. Replace the old protocol guide with durable Agent Map API documentation and complete the retained-owner, deletion-revision and recovery record. This final stack branch contains all SAP-3089, SAP-3090 and SAP-3091 work for combined local validation.

Related work

Related issue or discussion: SAP-3091. Part of the authorized cleanup stack above #892 and #893, targeting main. Human review follows the complete stack. Implementation and PR creation do not authorize merging or releasing it.

Validation

Verification on the cumulative implementation at cab477b5 (each earlier boundary also passed its affected build/typecheck and focused checks):

pnpm build — passed
pnpm typecheck — passed
pnpm lint — passed (existing warnings)
pnpm test — stops at the unchanged agent-core unreadable-directory test on this VM
pnpm --filter @sapiom/harness exec vitest run --maxWorkers=2 — 3,840 passed, 2 skipped
pnpm --filter @sapiom/harness test:perf — 10 passed
pnpm -r --filter @sapiom/mcp --filter @sapiom/cli --filter @sapiom/harness-desktop test — passed (179 + 73 + 205 cases; 3 MCP skips)
pnpm terminology:check — passed
pnpm provider-copy:check — passed
pnpm examples:check:test — 178 passed
pnpm pr-labeler:check — passed
pnpm pr-ci-security:check — passed

The root test failure reproduces on unchanged prior code; it is not treated as a green root run. The final retirement record includes artifact hashes, request-observation scope and all local limitations.

pnpm --filter @sapiom/harness test:ui --config /home/vercel-sandbox/sapiom/.context/sap-3089/playwright.config.mjs --workers=3 — 625/627 passed; two Chrome target crashes
pnpm --filter @sapiom/harness test:ui --config /home/vercel-sandbox/sapiom/.context/sap-3089/playwright.config.mjs --workers=2 template-harness — full affected file passed 23/23 unchanged
pnpm --filter @sapiom/harness test:canvas --config /home/vercel-sandbox/sapiom/.context/sap-3090-3091/playwright-canvas.config.mjs --workers=2 — 15 passed
node packages/harness-desktop/scripts/pack.mjs --linux — passed with copied dependencies and output redirected to task storage
bash packages/harness-desktop/scripts/smoke.sh — fresh linux-unpacked artifact passed 16 checks, 1 Windows-only skip
AppImage --appimage-extract-and-run --smoke --no-sandbox under Xvfb and the same isolated smoke setup — passed 16 checks, 1 skip on isolated rerun

Browser checks used installed Google Chrome, isolated TMPDIR and E2E_PORT=5497; the override changes only the executable, temporary output/report paths and Vite invocation. The package's 195 Harness runtime/assets match the clean build byte-for-byte. Its saved-map check records legacy read/refresh/navigation requests 0/0/0, direct removed routes 404/404/404, and unchanged map/history.

The first AppImage run failed session-create with a preexisting PROJECT_SESSION_SCOPE_UNAVAILABLE retention race; the identical artifact passed an isolated rerun. The initial failure and unchanged source ancestry are preserved in the record, with a separate follow-up test/fix outline. This cleanup does not fix that race. Signed macOS installer/upgrade evidence remains the SAP-3086 release gate.

Tests and documentation

Retained owner tests cover workspace identity, path containment, public exports, per-agent Canvas, discovery freshness and watch leases. New event tests reject retired/unknown envelopes and verify delivery/unsubscribe for supported events. Source and fresh dist searches find no legacy production graph imports or callers; remaining old route/event strings are explicit rejection probes. Independent read-only review found no defects.

Compatibility and release impact

• Breaking or externally visible changes: No further public endpoint change beyond the preceding server layer. Unknown or retired events cannot enter browser state subscribers. Recovery requires reverting changes into strictly higher package and desktop release versions.
• Changeset: N/A — the preceding server minor changeset covers the endpoint retirement; this layer deletes unreachable internals and updates its evidence.

Security

• I have not included secrets, credentials, private data, or unsanitized logs.
• This pull request does not publicly disclose a suspected vulnerability. I will follow the Security Policy for private reporting.

AI assistance

• I did not use AI assistance for this change.
• I used AI assistance and have described it below.

Codex implemented the cleanup and test/doc migrations, traced retained callers, and checked the resulting diffs. Automated checks above and independent read-only review provide implementation evidence; maintainer review is still required.

Checklist

• I read CONTRIBUTING.md, and this contribution follows the direct-PR or issue-first policy.
• This pull request addresses one focused problem and contains no unrelated cleanup.
• I added or updated tests, or explained above why tests are not applicable.
• I ran the relevant build, typecheck, lint, and test commands, or explained any N/A checks above.
• I updated documentation for user-facing changes, or marked it N/A above.
• I added a Changeset for a published-package change, or explained why it is not applicable.
• I can explain and maintain every submitted change, including any AI-assisted work.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}