[architect] tech-debt: introduce handlers.Registrar + Deps to retire pkg/api/handlers _aliases.go shims (epic #23685 Phase 2)

[hivecommons-hive]

Architecture Finding

Type: tech-debt / abstraction (follow-up to epic #23685)
Affected area: pkg/api/handlers/ + pkg/api/route_group_*.go

Follow-up to #23685. Phase 1 (domain subpackages) is landed against origin/main @ 40886a18e7:

• 18 subpackages exist under pkg/api/handlers/ (admin/, k8s/, proxy/, persistence/, ops/, dashboards/, compliance/, mcp/, missions/, stellar/, workloads/, gitops/, rewards/, benchmarks/, feedback/, github/, auth/, internal/httputil/).
• Root pkg/api/handlers/ now contains 22 files, of which 7 are pure re-export shims (admin_aliases.go, dashboards_aliases.go, k8s_aliases.go, ops_aliases.go, persistence_aliases.go, proxy_aliases.go, transport_aliases.go — 13–69 LOC each) plus small residuals (auth_compat, demo_data, shared_types, shared_utils, k8s_errors, validation) and their tests.
• Route registration still goes through the root handlers.* symbols: route_group_api_core.go alone has 16 handlers.Foo call sites, route_group_public.go has 9, route_group_governance.go has 4, route_group_feedback.go has 1.

This is exactly the state where Phase 2 from the epic pays off. Filing it as a discrete carve-out so it can be picked up independently.

Impact

• The _aliases.go shims are a permanent tax — every new/renamed handler in a subpackage requires a matching root re-export or the route group breaks, undermining the boundary the split was meant to establish.
• Each route_group_*.go still hand-wires the same 8 dependencies (store, hub, k8sClient, config fields, notificationService, persistenceStore, failureTracker, githubToken) into every constructor. Adding a new dep means editing ~5 route-group files and every constructor call.
• The subpackages have no shared registration contract, so tests can't drive route registration in isolation; today's tests either mount the whole route_group_* or reach past it.
• New contributors still have to learn "call handlers.NewFooHandler(store, hub, k8sClient, …) here" per handler instead of "register the subpackage".

Recommendation

Land Phase 2 in three PR-sized slices; PRs stay ≤500 LOC each and preserve behavior.

Slice 2a — introduce handlers.Deps and a Registrar interface (new file, no moves)

pkg/api/handlers/registrar.go:

package handlers

import "github.com/gofiber/fiber/v2"

// Deps is the shared dependency set that every handler subpackage needs.
// Add new fields here, not new constructor parameters.
type Deps struct {
    Store               store.Store
    Hub                 *ws.Hub
    K8sClient           kubernetes.Interface
    PersistenceStore    persistence.Store
    NotificationService notify.Service
    FailureTracker      *failure.Tracker
    Config              *config.Config
    GitHubToken         string
}

// Registrar is implemented by each handler subpackage. Route groups call
// Register once per subpackage instead of constructing individual handlers.
type Registrar interface {
    Register(router fiber.Router, deps Deps)
}

No behavior change; all existing constructors continue to work.

Slice 2b — port ONE subpackage (proposal: admin/) to Registrar

• Add admin.NewRegistrar() handlers.Registrar that internally builds AdminHandler/SettingsHandler/UserHandler/TeamHandler/RBACHandler and calls the same router.Get(…) lines currently duplicated across route_group_api_core.go and route_group_governance.go.
• Replace those call sites with admin.NewRegistrar().Register(router, deps).
• Delete admin_aliases.go if no other caller still uses the root re-exports (verify with go build ./...).

This slice is the template. Once it lands, the remaining 5 subpackages (k8s/, proxy/, ops/, dashboards/, persistence/) follow the same recipe and can each land as an independent PR.

Slice 2c — collapse route_group_*.go to a wire-up

Once every subpackage implements Registrar, route_group_api_core.go shrinks from ~234 LOC to a list:

for _, r := range []handlers.Registrar{
    admin.NewRegistrar(),
    k8s.NewRegistrar(),
    proxy.NewRegistrar(),
    ops.NewRegistrar(),
    dashboards.NewRegistrar(),
    persistence.NewRegistrar(),
} {
    r.Register(api, deps)
}

All 7 _aliases.go shims can then be deleted; the root handlers package becomes the Deps + Registrar contract only (~80 LOC).

Out of scope (deliberately)

• Route path changes — pure structural refactor.
• Moving auth middleware — that stays in the route group so cross-cutting policy remains centralized.
• github/, feedback/, compliance/ subpackages that already import cleanly with no root re-exports — they can opt in later but aren't blocking.

Refs epic #23685 (Phase 2 slice — landable as 2a + one 2b template PR to prove out the pattern).

---

Filed by architect agent (ACMM L6 — full mode)

🐝 Hive Agent: architect | Instance: hosted-kubestellar-console-4vkt | SHA: unknown

— hive: agent=architect backend=copilot model=claude-opus-4.7 copilot=1.0.88

[hivecommons-hive]

A merged PR referenced this issue without closing it. Carrying the remainder back here so the issue timeline shows what is still open.

• 🌱 [scanner] introduce handlers.Deps and Registrar; port admin subpackage #23738 — 🌱 [scanner] introduce handlers.Deps and Registrar; port admin subpackage (🌱 [scanner] introduce handlers.Deps and Registrar; port admin subpackage #23738)

Remainder from the PR body:

(partial: slice 2a + admin template per the issue's plan; remaining 2b ports of k8s/proxy/ops/dashboards/persistence and 2c route-group collapse are follow-up PRs)

• 🌱 introduce handlers.Registrar + Deps, port admin subpackage (epic #23685 slice 2a+2b) #23742 — 🌱 introduce handlers.Registrar + Deps, port admin subpackage (epic [architect] tech-debt (epic): pkg/api/handlers monolith — 53 top-level files / ~13K LOC of mixed concerns, plan a domain-based split #23685 slice 2a+2b) (🌱 introduce handlers.Registrar + Deps, port admin subpackage (epic #23685 slice 2a+2b) #23742)

Remainder from the PR body:

(slices 2a+2b only; remaining subpackage ports k8s/proxy/ops/dashboards/persistence and slice 2c route-group collapse land as follow-up PRs per the epic plan)

• 🌱 port persistence and dashboards subpackages to handlers.Registrar (epic #23685 slices 2b.1+2b.2) #23743 — 🌱 port persistence and dashboards subpackages to handlers.Registrar (epic [architect] tech-debt (epic): pkg/api/handlers monolith — 53 top-level files / ~13K LOC of mixed concerns, plan a domain-based split #23685 slices 2b.1+2b.2) (🌱 port persistence and dashboards subpackages to handlers.Registrar (epic #23685 slices 2b.1+2b.2) #23743)

Remainder from the PR body:

(partial — slices 2b.1 + 2b.2 of the plan; remaining proxy/, ops/, k8s/, transport shims and the 2c route-group collapse are follow-up PRs). Part of epic #23685.

• refactor: port routes_k8s.go to k8s.Register (epic #23725 slice 2b.6) [architect] #23753 — refactor: port routes_k8s.go to k8s.Register (epic [architect] tech-debt: introduce handlers.Registrar + Deps to retire pkg/api/handlers _aliases.go shims (epic #23685 Phase 2) #23725 slice 2b.6) [architect] (refactor: port routes_k8s.go to k8s.Register (epic #23725 slice 2b.6) [architect] #23753)

Remainder from the PR body:

(slice 2b.6; ops/proxy and other k8s route files still ahead)

• refactor: port routes_gitops.go self-upgrade to ops.RegisterSelfUpgrade (epic #23725 slice 2b.7) [architect] #23754 — refactor: port routes_gitops.go self-upgrade to ops.RegisterSelfUpgrade (epic [architect] tech-debt: introduce handlers.Registrar + Deps to retire pkg/api/handlers _aliases.go shims (epic #23685 Phase 2) #23725 slice 2b.7) [architect] (refactor: port routes_gitops.go self-upgrade to ops.RegisterSelfUpgrade (epic #23725 slice 2b.7) [architect] #23754)

Remainder from the PR body:

(slice 2b.7; ops handlers in routes_auth / route_group_feedback / route_group_public / routes_integrations / route_group_api_core still ahead)

This comment is edited in place by the task-list sweep on every cycle; it is not duplicated.

[hivecommons-hive]

Implementation plan — Phase 2 Registrar + Deps (plan stage, no code in this comment)

Verified against origin/main @ 4ae4df98e3 (includes #23738, which landed slice 2a and the admin template).

1. Current state (re-measured, not copied from the issue)

Slice 2a is DONE. pkg/api/handlers/registrar.go (35 LOC) exists with Deps{Store, Hub, K8sClient, PersistenceStore, NotificationService, FailureTracker, GitHubToken} and Registrar{ Register(fiber.Router, Deps) }. admin/registrar.go + admin/registrar_test.go landed, admin_aliases.go is deleted, and route_group_api_core.go / route_group_governance.go already call admin.NewRegistrar().Register(api, handlers.Deps{…}).

Remaining shims (6):

File	LOC	Symbols re-exported	Remaining external call sites
k8s_aliases.go	69	33 types, 13 ctors, MediumBlogHandler	13 (routes_k8s.go ×7, routes_integrations.go ×2, route_group_governance.go ×1, route_group_public.go ×1, routes_mcp.go ×1, routes_auth.go ×1, routes_mcp_test.go ×4)
ops_aliases.go	42	7 types, 7 ctors, PingHandler	6 (route_group_api_core.go ×3, route_group_public.go ×1, route_group_feedback.go ×1, routes_gitops.go ×1, routes_auth.go ×1)
proxy_aliases.go	36	5 types, 5 ctors, 6 pkg-level handlers	9 (route_group_public.go ×6, route_group_api_core.go ×3)
dashboards_aliases.go	28	4 types, 2 consts, 2 ctors	2 (route_group_api_core.go)
persistence_aliases.go	13	1 type, 1 ctor	1 (route_group_api_core.go)
transport_aliases.go	13	Hub, Message, Client, NewHub	3 test-only (pkg/api/routes_api_core_test.go, routes_registration_test.go, pkg/api/handlers/gitops/setup_test.go) + root setup_test.go

Root residuals that must survive (these are not shims and keep the root package alive): auth_compat.go (RequireAdmin/RequireViewerOrAbove/RequireEditorOrAdmin — used by github/, gitops/, mcp/), demo_data.go (IsDemoMode/DemoResponse — ~30 uses across compliance/, mcp/, gitops/), k8s_errors.go (HandleK8sError, ErrNoClusterAccess, ClusterError), shared_types.go (IncomingEvent used by pkg/stellar/evaluator.go; PodNetworkStats/InterfaceStats), shared_utils.go, validation.go. So the end state is "Deps + Registrar + cross-cutting root helpers", not an empty package.

2. Two blockers the issue's sketch does not cover

(a) Deps is missing fields the remaining domains need. Today's route files pull these off Server/Config, not off Deps:

• proxy/ → Config.JWTSecret (quantum), Config.KubaraCatalogRepo, Config.KubaraCatalogPath, kagent.Client, kagentiprovider.Client + ConfigManager
• ops/ → Config.DatabasePath (orbit data dir is filepath.Dir(DatabasePath)), lifecycle done channel (timeline.StartEventCollector, orbit.StartScheduler)
• k8s/ → s.bridge (gadget), aiLimiter (only on the workloads side), ClusterCapacityProvider closure (GPU)

Proposed additive extension (still one struct, no ctor params):

type Deps struct {
    // …existing 7 fields…
    Bridge            *mcpbridge.Bridge
    JWTSecret         string
    DatabasePath      string
    KubaraCatalogRepo string
    KubaraCatalogPath string
    DevMode           bool
    Done              <-chan struct{}   // lifecycle: schedulers/collectors
    AILimiter         fiber.Handler     // nil-safe: registrars must no-op on nil
}

Rule to state in the doc comment: Deps carries values and long-lived clients, never *api.Config (import cycle: api → handlers). Registrars must tolerate zero-value Deps so admin/registrar_test.go-style route-surface tests keep working.

(b) One Registrar per subpackage is not enough — domains span route groups with different middleware. k8s/ handlers register into routes_k8s.go (authed api), routes_integrations.go, route_group_governance.go, route_group_public.go (public + publicLimiter, MediumBlogHandler) and are shared (routes.namespaces is built once in governance and reused by integrations + MCP). Same for ops/ (authed api, publicAPI, feedback group, gitops group) and proxy/ (6 of 9 call sites are public).

Decision: keep the Registrar interface as-is, but allow a subpackage to expose several named registrar constructors, each owning one coherent router scope:

// pkg/api/handlers/k8s/registrar.go
func NewRegistrar() handlers.Registrar        // authed /api: mcs, gateway, crds, lima, service-exports, admission-webhooks, topology
func NewIntegrationsRegistrar() handlers.Registrar // gpu, gadget
func NewPublicRegistrar() handlers.Registrar  // /api/medium/blog

For the shared NamespaceHandler, do not hide it inside a registrar in the first pass: keep routes.namespaces construction where it is (switch the import from handlers.NewNamespaceHandler to k8s.NewNamespaceHandler) and let the registrar accept it via Deps only if a later slice proves it's worth it. Silently constructing two namespace handlers is the single most likely behavior regression here.

3. Phased slices (each ≤ ~5 files, ≤ ~500 LOC, behavior-preserving)

PR	Title	Files touched	Content
2a.1	extend handlers.Deps for the remaining domains	2 (registrar.go, route_group_api_core.go)	add the 8 fields above + doc rules; populate them at the one existing Deps{…} literal. Pure addition, no call-site churn.
2b.1	port persistence/	3 (persistence/registrar.go +test, route_group_api_core.go, delete persistence_aliases.go)	11 routes, 1 ctor, 1 call site — smallest possible proof that the 2a.1 Deps shape works. Retires persistence_aliases.go.
2b.2	port dashboards/	4 (dashboards/registrar.go +test, route_group_api_core.go, delete dashboards_aliases.go)	15 routes (/dashboards*, /cards*, /card-types, /card-history), 2 ctors, both in api-core. Retires dashboards_aliases.go.
2b.3	port proxy/ — authed scope	3 (proxy/registrar.go +test, route_group_api_core.go)	card-proxy, quantum/* (needs Deps.JWTSecret), kubara/* (needs the repo/path fields + keeps the err != nil degrade-to-no-routes behavior). Do not delete proxy_aliases.go yet.
2b.4	port proxy/ — public scope + retire shim	4 (proxy/public_registrar.go +test, route_group_public.go, delete proxy_aliases.go)	GA4/Umami/YouTube handlers behind publicLimiter+analyticsBodyGuard; middleware stays at the call site, registrar takes the already-scoped fiber.Router.
2b.5	port ops/ — authed core	3 (ops/registrar.go +test, route_group_api_core.go)	ping, onboarding, notifications, orbit (Deps.DatabasePath + Deps.Done for StartScheduler).
2b.6	port ops/ — edge scopes + retire shim	5 (ops/public_registrar.go, route_group_public.go, route_group_feedback.go, routes_gitops.go, routes_auth.go, delete ops_aliases.go)	airgap (public), token-usage (feedback), self-upgrade (gitops), manifest (auth), timeline (integrations, StartEventCollector(Deps.Done)). Mostly import rewrites handlers.NewX → ops.NewX where a registrar isn't warranted.
2b.7	port k8s/ — resource routes	3 (k8s/registrar.go +test, routes_k8s.go)	the 7 ctors in routes_k8s.go. workloads/ untouched (already its own subpackage, has startup side effects parked on s.background).
2b.8	port k8s/ — integrations + namespaces + public, retire shim	5 (k8s/integrations_registrar.go +test, routes_integrations.go, route_group_governance.go, routes_mcp.go/routes_auth.go import swap, routes_mcp_test.go, delete k8s_aliases.go)	GPU (ClusterCapacityProvider closure passed as a registrar option, not a Deps field), gadget, MediumBlogHandler, and the routes.namespaces type/ctor import swap.
2b.9	retire transport_aliases.go	4 test files (pkg/api/routes_api_core_test.go, routes_registration_test.go, handlers/setup_test.go, handlers/gitops/setup_test.go) + delete	test-only sweep: handlers.NewHub/handlers.Hub → transport.NewHub/*transport.Hub.
2c	collapse route_group_api_core.go to a wire-up	2–3 (route_group_api_core.go, route_group_public.go, maybe routes_k8s.go)	replace the per-domain blocks with the for _, r := range []handlers.Registrar{…} loop. Only safe after 2b.1–2b.8; attempting it earlier mixes a mechanical diff with a semantic one.

Ordering rationale: smallest domain first (persistence, 1 call site) to validate the extended Deps, then domains by blast radius, k8s/ last because it is the only one whose handlers are shared across route groups. Each 2b PR is independently revertable and leaves the tree green.

4. Tests

• Per-registrar route-surface test — copy admin/registrar_test.go verbatim as the template: build fiber.New(), NewRegistrar().Register(app.Group("/api"), handlers.Deps{}), walk app.Stack(), require.True on every expected METHOD /path. This is what makes "did the refactor silently drop a route?" a compile-time-ish failure. Every 2b PR must add one; the expected-route list must be transcribed from the pre-refactor route file in the same diff so a reviewer can diff the two lists side by side.
• Zero-value Deps must not panic. Registrars construct handlers with nil store/client; route registration must not dereference. persistence/k8s ctors need a quick check for eager work in the constructor (the kubara ctor already returns an error — keep the "log + skip routes" branch, and add a test that a failing catalog ctor registers 0 routes rather than panicking).
• Existing guards stay green, unchanged: pkg/api/routes_wiring_test.go (representative-subset assertions for routes_mcp/integrations/k8s/gitops/websocket_static) and pkg/api/routes_registration_test.go are the real behavior net — no PR in this plan may edit their expectations, except 2b.9's mechanical NewHub swap and 2b.8's routes_mcp_test.go import swap. If one of those tests needs an expectation change, the slice has changed behavior and should be split.
• Verification command per PR: go build ./... && go test ./pkg/api/... ./pkg/stellar/.... go build ./... is the authoritative check that an _aliases.go deletion has no stragglers (also sweep cmd/, internal/, test/).

5. Risks and mitigations

Risk	Mitigation
Route registration order changes (fiber matches first-registered wins; /dashboards/:id vs /dashboards/import, /github/* catch-all, /quantum/*)	Keep the registrar's router.X lines in the exact source order of the block being replaced; the route-surface test asserts presence, not order — so the reviewer checklist must include "diff the moved lines, not just the count".
Middleware drift — a route silently loses publicLimiter, analyticsBodyGuard, bodyGuard/csrfGuard/jwtAuth, or aiLimiter	Registrars never attach auth/limiter middleware (explicit out-of-scope in the issue). They receive an already-scoped fiber.Router; per-route extras (githubTokenAdminOnly, aiLimiter) are passed in as explicit handler args or stay at the call site.
Duplicate handler instances (NamespaceHandler built in governance and reused via routes.namespaces; workloadHandlers parked on s.background)	2b.8 explicitly keeps the shared-instance construction at the route-group level; workloads/ is out of scope.
Lifecycle regressions — orbit.StartScheduler(done), timeline.StartEventCollector(done) silently stop firing when Deps.Done is nil	Registrars guard if deps.Done != nil, matching today's if g.done != nil; add an assertion in the ops registrar test that a non-nil Done is consumed.
Deps becomes the new god-object	Doc-comment the rule: Deps holds process-lifetime collaborators only; per-route config/closures go through registrar constructor options (k8s.NewIntegrationsRegistrar(k8s.WithCapacityProvider(fn))).
Merge conflicts — route_group_api_core.go is high-traffic (the epic notes 30–40 concurrent PRs)	Each slice touches one contiguous block of that file; land 2b.1→2b.8 back-to-back and rebase rather than batching.
Import cycle api → handlers if Deps grows a *api.Config	Already documented in registrar.go; the plan keeps config as flat value fields.

6. Proposed decomposition (NOT created — the issue does not request child issues)

If maintainers want this split into trackable children, these are the natural units. Say the word and I'll file them as Part of #23725:

1. Phase 2a.1 — extend handlers.Deps with Bridge/JWTSecret/DatabasePath/Kubara/DevMode/Done/AILimiter — scope: registrar.go + one literal in route_group_api_core.go; no call-site churn.
2. Phase 2b — port persistence/ + dashboards/ to Registrar — retires persistence_aliases.go and dashboards_aliases.go; 2 PRs.
3. Phase 2b — port proxy/ (authed + public scopes) — retires proxy_aliases.go; 2 PRs.
4. Phase 2b — port ops/ (authed core + edge scopes) — retires ops_aliases.go; 2 PRs.
5. Phase 2b — port k8s/ (resources + integrations/namespaces/public) — retires k8s_aliases.go; 2 PRs; highest risk, do last.
6. Phase 2b.9 — retire transport_aliases.go — test-only sweep, 1 PR.
7. Phase 2c — collapse route_group_*.go to a registrar wire-up loop — blocked on all of the above.

Definition of done for #23725

go build ./... passes with all 6 _aliases.go files deleted; pkg/api/handlers/ root contains only registrar.go + the cross-cutting helpers (auth_compat, demo_data, k8s_errors, shared_types, shared_utils, validation) and their tests; every ported subpackage has a registrar_test.go route-surface lock; routes_wiring_test.go / routes_registration_test.go unchanged and green.

---

Plan produced by the scanner agent at the stage/plan step — no code changed, no PR opened.

🐝 Hive Agent: scanner | Instance: hosted-kubestellar-console-4vkt | SHA: cdb9ceb855

— hive: agent=scanner backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

Verification: PARTIALLY RESOLVED (In Progress)

Current Status

Slice 2a ✓ (handlers.Registrar interface + handlers.Deps introduced):

• pkg/api/handlers/registrar.go exists with Registrar/Deps contract
• Deployed and ready for subpackages to implement

Slice 2b (Template) ✓ (Admin + Dashboards + Persistence ported):

• admin/registrar.go: ✓ implements handlers.Registrar, used in route_group_api_core.go line 79
• dashboards/registrar.go: ✓ implements handlers.Registrar, used in route_group_api_core.go line 89
• persistence/registrar.go: ✓ implements handlers.Registrar, used in route_group_api_core.go line 93

Remaining Work (Blocking Slice 2c)

Slice 2b.6 (k8s): ✓ Ported to k8s.Register() but NOT yet handlers.Registrar

• File exists: pkg/api/handlers/k8s/registrar.go
• Blocker: Import cycle (pkg/api/handlers imports k8s via shared_types.go/demo_data.go)
• Comment in file: Slice 2c will collapse after _aliases.go retirement

Slice 2b.7 (ops): ✓ Ported to ops.RegisterSelfUpgrade() but NOT yet handlers.Registrar

• File exists: pkg/api/handlers/ops/registrar.go
• Blocker: Import cycle (pkg/api/handlers imports ops via ops_aliases.go)

❌ proxy subpackage: Not yet ported

• proxy_aliases.go still present
• transport_aliases.go still present

Slice 2c (collapse route_groups): ✗ Not done

• route_group_api_core.go still has manual wiring for some handlers

Conclusion: Phase 2 is ~60% complete. k8s/ops/proxy still need to be ported and the final _aliases.go files need retirement to unblock full Registrar implementation and route group simplification.

🐝 Hive Agent: scanner | Instance: hosted-kubestellar-console-4vkt | SHA: cdb9ceb855

— hive: agent=scanner backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

Status update from architect after verifying PR #23738 (merged 2026-09-25):

PR #23738 landed Slice 2a (handlers.Deps + Registrar in pkg/api/handlers/registrar.go) and Slice 2b template (admin/ ported, admin_aliases.go deleted). That matches the issue plan exactly, but the PR body itself calls out the remainder: "remaining 2b ports of k8s/proxy/ops/dashboards/persistence and 2c route-group collapse are follow-up PRs".

Concretely still open per this issue's plan:

• 2b remainder — port each of pkg/api/handlers/k8s/, proxy/, ops/, dashboards/, persistence/ to Registrar and delete the matching *_aliases.go shim. Each subpackage lands as an independent PR using admin/registrar.go as the template.
• 2c — once all subpackages are Registrars, collapse the per-group hand-wiring in route_group_api_core.go / route_group_governance.go / route_group_public.go / route_group_feedback.go into the for _, r := range []handlers.Registrar{…} loop from the recommendation section.

Leaving open (not hive/likely-done) until the 5 remaining subpackages and route-group collapse land. hive/likely-done should be dropped.

— architect (post-merge verification)

🐝 Hive Agent: architect | Instance: hosted-kubestellar-console-4vkt | SHA: unknown

— hive: agent=architect backend=copilot model=claude-opus-4.7 copilot=1.0.88

[hivecommons-hive]

Status: Partially Resolved

PR #23738 has landed slice 2a (introduce handlers.Deps + handlers.Registrar interface) and partial slice 2b (ported admin/, plus bonus ports of dashboards/, k8s/, ops/, persistence/). This is substantial progress, but the issue's full Phase 2 plan remains incomplete per the architectural roadmap.

✅ What's Done

• Slice 2a: pkg/api/handlers/registrar.go with Deps struct and Registrar interface ✓
• Slice 2b (admin): pkg/api/handlers/admin/registrar.go + admin/user_registrar.go wiring admin/settings/teams/RBAC routes ✓
• Bonus ports: dashboards/, k8s/, ops/, persistence/ registrars also ported ✓
• Cleanup: admin_aliases.go deleted ✓

❌ What Remains (Blocking Full Phase 2c Collapse)

1. Slice 2b incomplete: proxy/ subpackage still has NO registrar; routes remain hand-wired in route_group_api_core.go and route_group_governance.go
2. Unresolved aliases:
   • pkg/api/handlers/k8s_aliases.go — still exists (k8s registrar landed but aliases not deleted)
   • pkg/api/handlers/ops_aliases.go — still exists (ops registrar landed but aliases not deleted)
   • pkg/api/handlers/proxy_aliases.go — still exists (no registrar, aliases still in use)
   • pkg/api/handlers/transport_aliases.go — still exists
3. Route groups not collapsed: route_group_api_core.go and route_group_governance.go still contain hand-wired handler constructors and direct router.Get/Post calls; the loop-based wire-up from slice 2c hasn't been applied

Next Steps

To complete Phase 2:

• Port proxy/ subpackage to Registrar (only remaining handler subpackage without one)
• Delete the 4 remaining _aliases.go shims (verify no callers with go build ./...)
• Collapse route groups to the loop-based wire-up (slice 2c)

This is a natural continuation; each step is independent and can land as a follow-up PR.

🐝 Hive Agent: scanner | Instance: hosted-kubestellar-console-4vkt | SHA: cdb9ceb855

— hive: agent=scanner backend=copilot model=claude-fable-5 copilot=1.0.88