11b. Open-Core Boundary Audit (design 004, task C1)

Status: analysis / sign-off doc. This is the prerequisite classification for the open-core split. It does not flip any license — relicensing is a founder decision and is deliberately not automated. It records where the boundary is so the eventual rysh-engine extraction (C2/C3) is mechanical.

Guiding invariant

The license boundary must never cut through a trust claim. Anything marketed as protecting the user — SecretNAT, approval gates, the bash allowlist, the governance proxy's redaction — ships in the open, auditable half.

Headline finding

rysh-shared is already a clean engine module. Its only external dependencies are protoactor-go, nats.go, and google/uuid — no GORM, no gin, no server or database code. So design 004's "extraction" is largely a module rename + license + IP-hygiene operation, not a code refactor. There is no hidden engine→server coupling to unwind.

Verified: grep -rn "gorm|gin-gonic|rysh-server|database/sql" rysh-shared/**.go returns only a comment. Engine packages import only stdlib + protoactor + nats + uuid + image codecs.

Classification

OPEN — engine (`rysh-shared` → future `rysh-engine`, Apache 2.0)

Package	Role	Trust-claim code?
`agentic`	tool loop, orchestrator, approval strategies, compaction, sub-agents	yes (gates/approval)
`provider`	provider interface, Claude API/agentic, turn shapes, streaming, `Model()`	—
`secretnat`	SecretNAT detector + registered table + sanitize/restore	yes (redaction)
`tools`	the ~28 tool implementations + registry	partial (bash allowlist)
`msg`	NATSEnvelope, CodecRegistry, publisher, topics, usage schema (003)	—
`bridge`	NATS↔actor-mailbox bridge	—

All trust-claim code is engine-side ⇒ open/auditable ⇒ invariant satisfied.

OPEN — CLI application (`rysh-cli`, Apache 2.0)

The product shell that composes the engine. Notable packages:

Runtime & multiplexer: actors, bus, bridge, domain, session, tui, vterm, pipeline, relay, limits, config, logging, metrics.
Trust-claim (must stay open): proxy (governance proxy, design 001), usage (cost ledger, design 003 — enforcement feeds the proxy's 429), plus the SNAT/gate wiring in actors/agentic.
Feature surfaces: registry (client, design 005), forge (client-side generation — see note), channels (basic adapters), mcp, web, webauto, cdp, browserinstance, voice, cron.

rysh-cli imports rysh-shared via replace ../rysh-shared; it is excluded from go.work and built GOWORK=off. After extraction it imports rysh-engine directly.

PRIVATE — server & commercial (`rysh-server`, letchat, Forge service, enterprise)

Component	Why private
`rysh-server` (upstream hub, `NATSProxyService`, tenancy, billing, dashboard)	multiplayer/company value
Registry service (hosted index, publish, signing, web pages)	the "service" half of design 005 (format is open)
letchat.ai	product
Forge service (private-API tunneling, hosted generation)	commercial; client generation may open as a teaser
Enterprise: SSO/RBAC, org audit aggregation, central policy mgmt, vault glue	design 013, private tier

Extraction plan (C2/C3), unblocked by this audit

New rysh-engine module = today's rysh-shared packages, unchanged.
Transitional type aliases in rysh-shared so rysh-server compiles during the move; then flip rysh-cli/rysh-server imports to rysh-engine and delete aliases. go.work gains rysh-engine.
Because the dependency graph is already acyclic and server-free, no package needs to be split — only renamed/moved. Watch only for internal/ visibility (none of the engine packages are under an internal/ that rysh-server can't reach).

Deliberately NOT done here (founder/legal decisions)

Flipping LICENSE to Apache 2.0 (goreleaser currently declares Proprietary).
git-filter-repo history secret sweep (C4).
CLA-assistant, trademark filing, SECURITY.md disclosure inbox (C5/C6).

These are business/legal actions, not code, and are left to an explicit founder go-ahead. This audit makes them a one-day mechanical sequence when that call is made.