src/lib/README.md
src/lib/core/README.md
src/lib/onboard/README.md
src/lib/inference/README.md
src/lib/sandbox/README.md

src/lib/actions/README.md
src/lib/domain/README.md
src/lib/adapters/README.md
src/commands/internal/README.md

src/lib/commands/**  = oclif command adapters / parser glue
src/lib/actions/**   = workflow orchestration
src/lib/domain/**    = pure decisions / policy / classification
src/lib/adapters/**  = process, fs, Docker, OpenShell, network boundaries
src/lib/state/**     = persisted local state
src/lib/cli/**       = CLI framework/routing/help infrastructure
src/lib/core/**      = tiny cross-cutting primitives

src/lib/onboard/**
src/lib/inference/**
src/lib/sandbox/**
src/lib/policy/**
src/lib/shields/**
src/lib/credentials/**
src/lib/agent/**
src/lib/diagnostics/**
src/lib/dashboard/**
src/lib/deploy/**
src/lib/tunnel/**

branding.ts              -> cli/branding.ts or core/branding.ts
command-registry.ts      -> cli/command-registry.ts
terminal-style.ts        -> cli/terminal-style.ts
duration-flags.ts        -> cli/duration-flags.ts
version.ts               -> core/version.ts
ports.ts                 -> core/ports.ts
json-types.ts            -> core/json-types.ts
errno.ts                 -> core/errno.ts
wait.ts                  -> core/wait.ts
url-utils.ts             -> core/url-utils.ts
shell-quote.ts           -> core/shell-quote.ts

runner.ts                -> adapters/process/runner.ts eventually
subprocess-env.ts        -> adapters/process/env.ts
platform.ts              -> adapters/host/platform.ts
http-probe.ts            -> adapters/http/probe.ts

credentials.ts           -> credentials/store.ts
credential-filter.ts     -> security/credential-filter.ts
credential-hash.ts       -> security/credential-hash.ts
redact.ts                -> security/redact.ts
secret-patterns.ts       -> security/secret-patterns.ts

onboard.ts               -> onboard/flow.ts eventually
onboard-command.ts       -> onboard/legacy-command.ts or commands/onboard/**
onboard-types.ts         -> onboard/types.ts
onboard-session.ts       -> state/onboard-session.ts
onboard-providers.ts     -> onboard/providers.ts
onboard-inference-probes.ts -> inference/onboard-probes.ts
onboard-ollama-proxy.ts  -> inference/ollama/proxy.ts
onboard-vllm.ts          -> inference/vllm.ts
onboard-windows-ollama.ts -> inference/ollama/windows.ts
preflight.ts             -> onboard/preflight.ts
usage-notice.ts          -> onboard/usage-notice.ts

inference-config.ts      -> inference/config.ts
inference-health.ts      -> inference/health.ts
local-inference.ts       -> inference/local.ts
provider-models.ts       -> inference/provider-models.ts
model-prompts.ts         -> inference/model-prompts.ts
nim.ts                   -> inference/nim.ts
ollama-model-size.ts     -> inference/ollama/model-size.ts
web-search.ts            -> inference/web-search.ts

sandbox-config.ts        -> sandbox/config.ts
sandbox-build-context.ts -> sandbox/build-context.ts
sandbox-create-stream.ts -> sandbox/create-stream.ts
sandbox-version.ts       -> sandbox/version.ts
sandbox-channels.ts      -> sandbox/channels.ts or messaging/channels.ts
validation.ts            -> domain/sandbox/validation.ts
validation-recovery.ts   -> domain/sandbox/recovery-validation.ts
name-validation.ts       -> domain/sandbox/name-validation.ts

policies.ts              -> policy/presets.ts or actions/policy/presets.ts
tiers.ts                 -> domain/policy/tiers.ts
private-networks.ts      -> domain/network/private-networks.ts
shields.ts               -> shields/index.ts
shields-timer.ts         -> shields/timer.ts
shields-audit.ts         -> shields/audit.ts
messaging-conflict.ts    -> messaging/conflict.ts
chat-filter.ts           -> messaging/chat-filter.ts

agent-defs.ts            -> agent/defs.ts
agent-onboard.ts         -> agent/onboard.ts
agent-runtime.ts         -> agent/runtime.ts

debug.ts                 -> diagnostics/debug.ts
debug-command.ts         -> diagnostics/debug-command.ts
dashboard-contract.ts    -> dashboard/contract.ts
dashboard-health.ts      -> dashboard/health.ts
dashboard-recover.ts     -> dashboard/recover.ts
runtime-recovery.ts      -> runtime/recovery.ts
registry-recovery-action.ts -> actions/registry/recover.ts or actions/gateway/registry-recovery.ts
gateway-runtime-action.ts   -> actions/gateway/runtime.ts

deploy.ts                -> actions/deploy/index.ts eventually
build-context.ts         -> deploy/build-context.ts or sandbox/build-context-errors.ts
cluster-image-patch.ts   -> deploy/cluster-image-patch.ts
services.ts              -> tunnel/services.ts
services-command.ts      -> tunnel/command.ts