refactor: remove dead adapter, locator, storage and plugin subsystems (#487, part 1)

[mlieberman85]

Summary

Part 1 of 3 for #487: remove subsystems that no audit or remediation reaches. Each was re-checked against current main before removal: packages/*/src, entry points, workspace config, CI, scripts, tests. This PR removes about 8,000 lines, including about 4,200 in product source. Each subsystem is its own commit, so it can be reviewed commit by commit. The spec commit comes first.

Commit	Removed	Why it was dead
spec	adapters, AdapterRegistry, and UnifiedLocator.sync_to_project from framework-design.md (1.0.0-alpha.15; Appendix C lists the removals)
A	remediation/routing.py, 15 of the 16 classes in threat_model/models.py (StrideCategory stays), RemediationResult.to_markdown	no source callers
B	darnit.storage and generate_attestation_from_results(storage_config=)	no caller passes storage_config; replaced by darnit.stores
C	darnit.locate (UnifiedLocator) and CheckContext.locator	built on every audit, read by no handler. The control locator TOML config is a separate, live feature and stays
D	packages/darnit-plugins	never published or installed; its entry points were never registered
E	darnit-testchecks adapters and their three entry-point groups	no code reads those groups; its [adapters.builtin] named a class that doesn't exist
F	darnit.core.adapters and the adapter half of PluginRegistry	get_adapter_registry had no callers; framework discovery stays
G	adapter config models, ControlConfig.check, FrameworkDefaults, the adapter= filter, adapter output in plan and validate	parsed and printed, never dispatched

As decided for 0.2.0, there are no deprecation shims. Every removed public name has a BREAKING entry under CHANGELOG ### Removed.

Load behavior:

• A control-level check = {...} now fails strict loading. ControlConfig forbids extra keys, and the key never did anything.
• A leftover [adapters] table or [defaults] check_adapter still loads (top-level tables allow extras) and has no effect. The shipped frameworks drop their [defaults] blocks.
• New tests in test_merger.py cover both cases.

The module-path policy from #490 is still tested for its two remaining callers, ToolRegistry.load_handler and HandlerRegistry.get_handler.

Parts 2 and 3, later PRs:

• 2: trim the unused ComplianceImplementation methods (get_rules_catalog, get_remediation_registry, get_all_controls, get_controls_by_level, register_controls), coordinated with Standardize on one sieve-handler registration method across plugins #451.
• 3: fold darnit-example into darnit-testchecks.

Refs #487

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Framework Changes Checklist

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed
• Ran uv run python scripts/validate_sync.py --verbose and it passes

Testing

• Tests pass locally (uv run pytest tests/ -v): 5148 passed, 26 skipped
• Added tests for new functionality (if applicable)
• Linting passes (uv run ruff check .)

main has 5252 passing tests. Of the 104 fewer here:

• 98 were in deleted test files for the removed code (routing, threat-model classes, storage, locate);
• 8 were removed from files that remain;
• 2 are new.

Integration tests with GitHub Actions environment variables set: 334 passed. Smoke runs:

• darnit audit ., darnit audit . -f reproducibility: run as before;
• darnit plan and darnit validate on testchecks and community-spec: work, without the adapter lines.

AI assistance

• No AI assistance was used
• AI assistance was used

Claude (Claude Code, claude-opus-5-5) re-checked each item in #487 against current main and made the removals, spec edits, and test updates. This description was also drafted with Claude. Commits carry an Assisted-by: Claude:claude-opus-5-5 trailer.

Additional Notes

• Not from this PR: darnit plan and darnit validate on openssf-baseline crash on main with TypeError in sorted(by_level). Every baseline control loads with level=None.
• Left for follow-ups:
  • The attestation predicate still writes adapters_used: ["builtin"]. Attestation consumers can see that field, so dropping it is a spec change.
  • EffectiveControl.remediation_handler and remediation_config are also unread.
  • Generated threat-model data (docs/threatmodel/raw-findings.json, .project/threatmodel/mitigations.yaml) still names deleted files. The rendered threat-model docs got "(removed in 0.2.0, Remove dead adapter system, legacy storage backend, unused protocol methods, and other unreachable code (~3,500 lines) #487)" notes instead of being rewritten.
  • docs/plugin-discovery-design.md is a design record. It gets a header note rather than a rewrite.

🤖 Generated with Claude Code