refactor(loc-cap): extract registry keys and sync under crate caps

Split gateway registry, challenge key load, and validator SyncChain into
workspace crates so each package stays at or below the 1500 non-test LOC
cap. Preserve public parent APIs via pub use facades.

Author: echobt

Cargo.lock

@@ -0,0 +1,17 @@
+[package]
+name = "agent-challenge-keys"
+description = "Challenge signing key load for agent-v1"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+publish = false
+
+[dependencies]
+crypto = { path = "../crypto" }
+hex = "0.4"
+thiserror = "2"
+
+[lints]
+workspace = true

crates/agent-challenge-keys/Cargo.toml

@@ -12,6 +12,7 @@ publish = false
 bundle = { path = "../bundle" }
 chain = { path = "../chain" }
 crypto = { path = "../crypto" }
+agent-challenge-keys = { path = "../agent-challenge-keys" }
 trustroot = { path = "../trustroot" }
 agent-pack = { path = "../agent-pack" }
 agent-dispatch = { path = "../agent-dispatch" }

crates/agent-challenge/src/keys.rs crates/agent-challenge-keys/src/lib.rscrates/agent-challenge/src/keys.rs renamed to crates/agent-challenge-keys/src/lib.rs

@@ -362,7 +362,7 @@ mod tests {
     #![allow(clippy::unwrap_used, clippy::expect_used)]
 
     use super::*;
-    use crate::keys::public_key_from_secret;
+    use agent_challenge_keys::public_key_from_secret;
     use rand_core::OsRng;
     use trustroot::{ChallengeEntry, ParticipantPolicy, BPS_DENOM};
 

crates/agent-challenge/Cargo.toml

@@ -7,17 +7,11 @@
 
 #![forbid(unsafe_code)]
 
-mod challenge;
-mod epoch_loop;
-mod expected_set;
-mod intake;
-mod keys;
-mod leaf_map;
-mod score;
-mod submit;
-mod task_gen;
-mod verify;
+mod challenge; mod epoch_loop; mod expected_set;
+mod intake; mod leaf_map; mod score;
+mod submit; mod task_gen; mod verify;
 
+pub use agent_challenge_keys::{load_challenge_secret, public_key_from_secret, ChallengeKeyError};
 pub use challenge::{
     correct_http200, correct_http200_fixture, emit_signed_leaf_set, leaf_from_verify_result,
     score_epoch_from_verify, silence_is_bug_leaf, AgentV1Challenge, AttestationLookup, Challenge,
@@ -37,7 +31,6 @@ pub use intake::{
     intake_and_grade, verify_intake_receipt, ExpectedReceiptBind, IntakeOk, IntakePatch,
     ReceiptBindError,
 };
-pub use keys::{load_challenge_secret, public_key_from_secret, ChallengeKeyError};
 pub use leaf_map::{
     attempts_within_seal_budget, cover_expected_verify_leaves, grade_to_score_or_absence,
     grade_to_score_or_absence_budgeted, is_operator_fault, is_retryable_operator_fault, map_reward,
@@ -52,17 +45,12 @@ pub use submit::{
     SubmitError, SubmitOutcome, DEFAULT_MAX_RETRIES,
 };
 pub use task_gen::{
-    answer_digest, answer_digest_v2, task_blob, task_blob_v2, task_id, task_id_v2,
-    ANSWER_DOMAIN_V2, CHALLENGE_ID, CHALLENGE_ID_BYTES, FIXTURE_MODEL_PATCH, FIXTURE_PACK_ID,
-    SCORING_VERSION, SCORING_VERSION_V2, TASK_BLOB_DOMAIN_V2, TASK_ID_DOMAIN_V2,
-};
-
-pub use bundle::{
-    make_signed_leaf, raw_weight_payload, LeafV1, NoScoreReasonCode, RawWeightBodyV1,
-    ScoreOrAbsence,
+    answer_digest, answer_digest_v2, task_blob, task_blob_v2, task_id, task_id_v2, ANSWER_DOMAIN_V2,
+    CHALLENGE_ID, CHALLENGE_ID_BYTES, FIXTURE_MODEL_PATCH, FIXTURE_PACK_ID, SCORING_VERSION,
+    SCORING_VERSION_V2, TASK_BLOB_DOMAIN_V2, TASK_ID_DOMAIN_V2,
 };
+pub use bundle::{make_signed_leaf, raw_weight_payload, LeafV1, NoScoreReasonCode, RawWeightBodyV1, ScoreOrAbsence};
 pub use crypto::{KEY_LEN, SIGNATURE_LEN};
-
 pub use verify::{
     map_docker_timeout, reward_from_json_bytes, HarborVerifier, HarborVerifierConfig, Reward,
     Verifier, VerifyError, ZeroReason, DEFAULT_VERIFIER_TIMEOUT_SEC,

crates/agent-challenge/src/challenge.rs

@@ -0,0 +1,21 @@
+[package]
+name = "gateway-registry"
+description = "Gateway backend registry (routing only, D18) — extracted for loc-cap"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+publish = false
+
+[dependencies]
+parking_lot = "0.12"
+serde = { version = "1", features = ["derive"] }
+thiserror = "2"
+uuid = { version = "1", features = ["v4", "serde"] }
+
+[dev-dependencies]
+serde_json = "1"
+
+[lints]
+workspace = true

crates/agent-challenge/src/lib.rs

@@ -12,6 +12,7 @@ publish = false
 axum = { version = "0.8", default-features = false, features = ["http1", "tokio", "json", "query"] }
 bytes = "1"
 aggregate = { path = "../aggregate" }
+gateway-registry = { path = "../gateway-registry" }
 bundle = { path = "../bundle" }
 chain = { path = "../chain" }
 config = { path = "../config" }

crates/gateway-registry/Cargo.toml

@@ -14,9 +14,9 @@ use serde::Deserialize;
 use trustroot::ChallengesBody;
 use uuid::Uuid;
 
-use crate::registry::{BackendView, CreateBackend, Registry, RegistryError};
 use crate::sealer::{MemoryBundleStore, SharedBundleStore};
 use crate::weights::{MemoryRawWeightStore, SharedWeightStore};
+use gateway_registry::{BackendView, CreateBackend, Registry, RegistryError};
 
 /// Shared axum state for registry + proxy + weights + sealed bundles.
 #[derive(Clone)]