refactor: rename review harness cli

README.md

@@ -109,9 +109,9 @@ Supervisor contract:
 
 Issue #37 is intentionally split into reviewable child slices: executable CLI setup (#38), repo-generic planning (#39), probe/readiness reliability (#40), doctor diagnostics (#41), worker reporting (#42), and multi-worker orchestration (#43).
 
-### Review CLI Harness
+### Review Harness Boundary
 
-`kapi-review github-pr` emits non-posting JSON for kapi-agent review/check automation. The harness now reports semantic change metrics, a `TRIVIAL`/`LOW_RISK`/`STANDARD`/`HIGH_RISK`/`CRITICAL` risk profile, required evidence gates, structured finding validation, bundled repo-local review guidance, isolated read-only runner prompt provenance, optional `--runner-output-file` structured findings ingestion, optional `--runner-command` isolated runner invocation, and the legacy changed-line context. Runner commands receive a temporary `KAPI_REVIEW_RUNNER_INPUT` JSON file containing the read-only runner metadata, risk/context, review body, and the bundled-guidance prompt material, execute from that temporary workspace with a minimal sanitized environment, then return structured findings JSON for deterministic validation. Size is a risk signal rather than the only decision: docs/generated-heavy changes can pass the size gate when semantic source risk is low, while sensitive paths require stronger evidence even when small. Low-confidence `BLOCKER` findings are normalized to non-blocking `QUESTION` findings so uncertain reviewer signals do not masquerade as merge-blocking defects. GitHub merge enforcement for formal kapi-agent approval lives in `.github/workflows/kapi-agent-formal-approval-gate.yml`; require `require formal kapi-agent approval` plus `kapi-agent/review` in branch protection/rulesets. Re-review requests after stale/non-approving kapi-agent reviews must put `@kapi-agent review`, the current head SHA, `What changed`, `Why this closes the prior feedback`, and `Verification` in the same author comment; see `docs/kapi-agent-approval-gate.md`.
+`kapi-agent` owns the deterministic Ilchul structured review adapter and GitHub formal review/check publication from the github-bot deployment. Ilchul keeps the branch protection contract and revision-comment rules documented here, but it no longer exposes a package `ilchul-review` or `kapi-review` bin for review automation. GitHub merge enforcement for formal kapi-agent approval lives in `.github/workflows/kapi-agent-formal-approval-gate.yml`; require `require formal kapi-agent approval` plus `kapi-agent/review` in branch protection/rulesets. Re-review requests after stale/non-approving kapi-agent reviews must put `@kapi-agent review`, the current head SHA, `What changed`, `Why this closes the prior feedback`, and `Verification` in the same author comment; see `docs/kapi-agent-approval-gate.md`.
 
 ### Agent Tools
 

docs/ilchul-naming-policy.md

@@ -31,7 +31,7 @@ Examples:
 Keep `kapi` when changing it would break an existing integration or stored contract without an approved migration:
 
 - Slash commands and persisted workflow surfaces retained for compatibility such as `/kapi-ralph`, `/kapi-status`, and `/kapi-clear`;
-- package names, bin names, import paths, and GitHub workflow/check names such as `kapi-agent/review`;
+- GitHub workflow/check names such as `kapi-agent/review`; the former `kapi-review` and proposed `ilchul-review` local package bins are not exposed by Ilchul because deterministic review automation now belongs to the github-bot adapter;
 - existing workflow IDs and serialized identifiers such as `kapi-ralph` and `kapi-autoresearch`;
 - existing local workspace state under `.kapi/` and historical docs that describe current behavior;
 - compatibility docs for existing installations or migration windows.
@@ -90,7 +90,7 @@ No slice should hide deletion behind normal workflow start, status, report, or v
 ## Deprecated or retained names
 
 - Retained until scoped migration: `kapi`, `/kapi-*`, `kapi-agent`, `kapi-agent/review`, `kapi-ralph`, and `kapi-autoresearch`.
-- Canonical public CLI runtime command: `ilchul`; there is no `kapi` runtime CLI compatibility alias. Internal runtime modules use `runctl` / `runtime` naming.
+- Canonical public CLI command: `ilchul` for the runtime; there is no `kapi`, `kapi-review`, or `ilchul-review` CLI compatibility alias in the Ilchul package. Internal runtime modules use `runctl` / `runtime` naming. Review automation remains an external `kapi-agent` / github-bot responsibility, not a public package bin or reusable implementation module.
 - Active storage behavior: `.ilchul` / `~/.ilchul`; `.kapi` is legacy local state only and is not an active fallback root.
 - Preferred for new product prose: `Ilchul`.
 - Preferred for new reusable core identifiers: semantic terms from the vocabulary table.

docs/kapi-agent-approval-gate.md

@@ -44,13 +44,13 @@ This makes the PR unmergeable in GitHub until the formal current-head review and
 
 ## Ilchul review harness contract
 
-`kapi-agent` remains the GitHub adapter/check publisher. The Ilchul review harness returns non-posting JSON with:
+`kapi-agent` remains the GitHub adapter/check publisher and now owns the deterministic structured review adapter in the github-bot deployment. Ilchul does not expose a package `ilchul-review` or `kapi-review` bin for review automation; this repository only documents the branch-protection and revision-comment contract that the external bot enforces. The bot-side harness returns non-posting JSON with:
 
 - semantic metrics for raw, source, test, docs, generated, and sensitive-path changed lines;
 - a risk profile (`TRIVIAL`, `LOW_RISK`, `STANDARD`, `HIGH_RISK`, or `CRITICAL`);
 - deterministic gates for size, verification, revision explanation, final approval summary, required evidence, and finding validation;
 - bundled repo-local review guidance from `skills/ilchul-code-review/SKILL.md`;
-- isolated runner invocation via `--runner-command`, where the command receives `KAPI_REVIEW_RUNNER_INPUT` with read-only runner metadata and bundled-guidance prompt material, runs from the temporary input workspace, and receives only a minimal runner environment; and
+- isolated runner invocation, when enabled by the bot-side adapter, with read-only runner metadata, bundled-guidance prompt material, a temporary workspace, and a minimal runner environment; and
 - structured findings whose blocker severity requires concrete file/line/evidence/confidence and `mergeBlocking=true`.
 
 Docs/generated-heavy changes may avoid automatic size failure when semantic risk is low. Small sensitive-path changes still escalate and require targeted evidence. The bundled guidance steers isolated review execution, but deterministic harness validation remains the gate authority.

docs/product-name-audit.md

@@ -14,12 +14,12 @@ git grep -n -i -E 'kapi|ilchul' -- ':!package-lock.json' ':!node_modules'
 
 | Surface | Current state | Classification | Follow-up direction |
 | --- | --- | --- | --- |
-| Package metadata | `package.json` is still named `ka-pi`; package bins include public `ilchul` and external `kapi-review`, but no `kapi` runtime bin. | package brand / external review integration | Do not retain a `kapi` runtime CLI alias. Prefer `ilchul` for public runtime docs and examples; reserve `runctl` for internal runtime implementation naming. Keep `kapi-review` while the GitHub review integration uses that command. |
+| Package metadata | `package.json` is still named `ka-pi`; package bins include only public `ilchul`; review automation is owned by the external `kapi-agent` github-bot adapter, and there is no `kapi` runtime bin. | package brand / external review integration | Do not retain a `kapi` runtime CLI alias. Prefer `ilchul` for public runtime docs and examples; reserve `runctl` for internal runtime implementation naming. Do not add an Ilchul package review bin; keep `kapi-agent` and `kapi-agent/review` as GitHub integration names while the GitHub App uses them. |
 | CLI runtime entrypoint | `src/cli/runctl-cli.ts` and related tests use semantic runtime names. This slice keeps the public `ilchul` command wired through the internal `bin/runctl.mjs` wrapper and semantic `parseRuntimeArgs` / `runRuntimeCli` exports, removes the old `bin/kapi.mjs` shim, and verifies package-local/prefix installs do not expose `kapi`. | public brand command with internal semantic implementation | Internal runtime callers should import from `src/cli/runctl-cli.ts` and use semantic runtime exports; product-named runtime command aliases must not be reintroduced at the package/bin edge. |
 | CLI setup helper | `setup:cli` still invokes `scripts/setup-runctl-cli.mjs`, but its completion text now points to `ilchul --help`. | internal semantic filename plus brand-facing user guidance | Keep output brand-facing where users see it and implementation filename semantic internally. |
 | Slash commands and workflow IDs | `/kapi-*`, `kapi-ralph`, `kapi-autoresearch`, and related state fields remain serialized workflow contracts. | persisted compatibility identifiers | Do not rename without an explicit compatibility/deprecation migration. |
 | Storage/config | `.ilchul`, `~/.ilchul`, `.kapi` historical references, and `ILCHUL_*` environment variables appear in docs/tests/runtime setup. | storage/config namespace | `.ilchul` is active storage; `.kapi` is legacy evidence only and must not be deleted by this issue. |
-| GitHub review integration | `kapi-agent`, `kapi-agent/review`, and `kapi-review` remain literal external integration names. | external integration | Keep literal names while the GitHub App and required checks use them. |
+| GitHub review integration | `kapi-agent` and `kapi-agent/review` remain literal GitHub integration names; deterministic review-gate automation is owned by the github-bot adapter, not an Ilchul package bin. | external integration | Keep literal names while the GitHub App and required checks use them. |
 | Documentation/history | README, policy docs, references, and historical explanations still mention Kapi and Ilchul. | documentation/history | New public runtime examples should use `ilchul`; internal implementation examples may use `runctl` / `runtime`; historical and compatibility prose may keep product names with context. |
 | Core/domain/application identifiers | The registry entry type now uses `WorkflowRegistryEntry`; the store interface/class now use `WorkflowStore` / `FileWorkflowStore`; the service class and active tests now use `WorkflowService` without the temporary `KapiService` compatibility export. | reusable-code leakage removed from the active service/store surface | Keep future reusable service/store imports on the semantic `Workflow*` names. |
 | Application service filenames | The service implementation and factory now use semantic filenames: `src/application/workflow-service.ts` and `src/adapters/workflow-service-factory.ts`; the primary exported service class is now `WorkflowService`. | internal semantic implementation | Keep imports on the semantic service paths; do not reintroduce a product-named service alias for reusable internal code. |
@@ -39,36 +39,70 @@ git grep -n -i -E 'kapi|ilchul' -- ':!package-lock.json' ':!node_modules'
 - Service source surfaces now use semantic `WorkflowService` in the implementation, local factory, presentation layer, runtime probe scripts, and active tests; the temporary `KapiService` export has been removed after migrating the large remaining test clusters.
 - Presentation registration/UI action helpers now use semantic workflow names (`registerWorkflowExtension`, `registerWorkflowCommandsAndTools`, `registerWorkflowTools`, `WorkflowUiActionContext`, `installWorkflowAutocomplete`, `toggleWorkflowWidgetExpanded`) while leaving public `kapi_*` tool names and `/kapi-*` contracts intact.
 - Adapter/domain private helper names now use semantic state/workflow naming for symlink guards, managed autoresearch symlinks, worker branch validation, and prompt rule rendering while preserving user-facing Kapi contract text.
-- Review gate helper exports now use semantic review-gate names (`ReviewGateInput`, `ReviewGateResult`, `buildReviewGate`, `runReviewGateCli`, `parseReviewGateArgs`, `REVIEW_GATE_MAX_CHANGED_LINES`) while preserving the `kapi-review` CLI and `kapi-agent` review contract text.
-- Runtime package metadata now exposes only the `ilchul` runtime bin and the external `kapi-review` review harness; `kapi` is absent from `package.json` / `package-lock.json`, `bin/kapi.mjs` is removed, and `test/cli-bin.test.ts` asserts package-local and isolated-prefix installs do not expose a `kapi` runtime command.
+- Review-gate package/source ownership moved out of Ilchul to the github-bot `kapi-agent` adapter. Ilchul keeps only the branch-protection and revision-comment documentation for the external review integration.
+- Runtime package metadata now exposes only the `ilchul` runtime bin; `kapi`, `kapi-review`, and `ilchul-review` are absent from `package.json` / `package-lock.json`, `bin/kapi.mjs` is removed, and `test/cli-bin.test.ts` asserts package-local and isolated-prefix installs do not expose retired runtime/review commands.
 
 ## Residual scan after runtime alias removal
 
 ```text
-find src -iname '*kapi*' -print
-src/.kapi
-src/.kapi/lanes/kapi-autoresearch
-src/.kapi/lanes/kapi-autoresearch/kapi-ux-개선-계획
-src/cli/kapi-review-cli.ts
+git ls-files 'src/*kapi*' 'src/**/*kapi*' | sort
+# no tracked filename hits
 
 node -e 'const p=require("./package.json"); console.log(JSON.stringify(p.bin,null,2))'
 {
-  "ilchul": "./bin/runctl.mjs",
-  "kapi-review": "./src/cli/kapi-review-cli.ts"
+  "ilchul": "./bin/runctl.mjs"
 }
 
-rg -n '"kapi"\\s*:|bin/kapi|npm exec -- kapi|kapi compatibility alias|kapi --help' package.json package-lock.json README.md docs test bin src scripts
- test/cli-bin.test.ts:41:test("package metadata exposes ilchul runtime bin without kapi compatibility alias", async () => {
+rg -n '"kapi"\\s*:|"kapi-review"|"ilchul-review"|bin/kapi|bin/ilchul-review|npm exec -- kapi|kapi compatibility alias|kapi --help' package.json package-lock.json README.md docs test bin src scripts
+# hits are limited to negative assertions in test/cli-bin.test.ts plus documentation of retired command names
 ```
 
-Remaining `src/` filename hits are legacy fixture state under `src/.kapi` and the literal `kapi-review` external integration CLI. Runtime package metadata no longer exposes a `kapi` bin, and the old direct `bin/kapi.mjs` shim is removed.
+Tracked `src/` filename scans no longer include `kapi` filenames from the review-gate compatibility shim. Runtime package metadata exposes only the `ilchul` bin: `kapi`, `kapi-review`, and `ilchul-review` are not package bins, and the old direct `bin/kapi.mjs` shim is removed. Review-gate automation now belongs to the github-bot `kapi-agent` adapter. Local ignored/generated fixture state under `src/.kapi` may exist in developer worktrees, but it is not part of the committed source tree scan.
+
+## Final acceptance scan counts
+
+The final issue #209 residual scans were run against the committed runtime-alias-retirement tree. Active `src/` content counts exclude only ignored/generated fixture state so the evidence is reproducible from a clean checkout:
+
+```text
+rg -n -i 'kapi' src --glob '!src/.kapi/**' --glob '!src/.git/**'
+# 497 matching lines / 586 matches across 36 active src files
+
+rg -n 'Kapi[A-Z]|\bkapi[A-Z_-]|kapi-' src test docs package.json package-lock.json
+# 1292 matching lines / 1476 matches across source, tests, docs, and package metadata
+
+rg -n '\b(class|interface|type|function|const|let|var|enum)\s+[A-Za-z0-9_]*Kapi[A-Za-z0-9_]*|\b(class|interface|type|function|const|let|var|enum)\s+kapi[A-Za-z0-9_]*' src
+# no internal reusable declaration-name hits
+```
+
+Active `src/` residual category counts:
+
+| Category | Lines | Matches | Files | Why retained |
+| --- | ---: | ---: | ---: | --- |
+| User-facing compatibility text | 228 | 240 | 25 | Status/help/diagnostic wording still describes the existing Kapi workflow contract exposed to users. |
+| Serialized workflow/event contracts | 124 | 147 | 20 | Workflow IDs, event kinds, run-contract source kinds, and persisted state keys remain compatibility contracts. |
+| Slash commands / public tool contracts | 99 | 126 | 12 | `/kapi-*`, `kapi_*`, and `@kapi:` surfaces are public contract names pending a separate migration plan. |
+| External review integration | 20 | 44 | 6 | `kapi-agent`, `kapi-agent/review`, PR review-state helpers, and GitHub review-check literals are external integration boundaries; package review CLI exposure moved to github-bot. |
+| Environment/runtime compatibility | 10 | 11 | 7 | `KAPI_*` environment variables remain compatibility inputs for runtime dispatch and tests. |
+| Other compatibility literals | 16 | 18 | 10 | Shell labels, fixture command strings, and small compatibility literals that are not reusable implementation identifiers. |
+
+## Issue #209 acceptance mapping
+
+| Acceptance criterion | Status | Evidence |
+| --- | --- | --- |
+| `src/` contains no `kapi` in filenames except explicitly justified boundary exceptions. | Met | Tracked filename scan has no `src/*kapi*` hits; ignored/generated local `src/.kapi` fixture state is not part of the committed source tree. |
+| Internal reusable exports/types/functions/classes no longer use `Kapi*` / `kapi*` naming. | Met | Declaration-name scan returns no active `src` hits. Remaining exported literals are serialized contracts, event names, or external integration strings. |
+| Remaining `kapi` hits in `src/` are limited to documented compatibility contracts, serialized workflow IDs, slash-command literals, or intentionally named external integrations. | Met | Category table above classifies all 497 active `src` matching lines / 586 matches. |
+| Public runtime command examples remain `ilchul`; internal implementation names remain generic. | Met | Package bins expose only `ilchul`; runtime internals use `runctl` / `runtime` / `workflow` / `worker` names where reusable. |
+| Tests prove package/runtime CLI does not expose a `kapi` runtime alias. | Met | `test/cli-bin.test.ts` covers package-local `npm exec -- kapi --help` failure and isolated-prefix absence of a `kapi` shim. |
+| Final scan report includes remaining exception categories and counts. | Met | This section records filename, content, semantic scan, declaration scan, and residual category counts. |
 
 ## Remaining justified product-name identifiers
 
-- **External review integration:** `kapi-review`, `kapi-agent`, `kapi-agent/review`.
-- **Persisted contracts:** `/kapi-*` slash commands, `kapi-*` workflow IDs, existing serialized state expectations.
-- **Storage/config namespace:** `.ilchul`, `~/.ilchul`, `ILCHUL_*`, legacy `.kapi` references.
-- **External integration:** `kapi-agent`, `kapi-agent/review`.
+- **External review integration:** `kapi-agent`, `kapi-agent/review`, and historical docs that explain retired review CLI names.
+- **Persisted contracts:** `/kapi-*` slash commands, `kapi-*` workflow IDs, `kapi.worker.*` / `kapi.pr.*` event names, `kapi-workflow` run-contract source kind, and existing serialized state expectations.
+- **Public tool / command contracts:** `kapi_*` tool names and `@kapi:` UI completion syntax.
+- **User-facing compatibility text:** status, help, validation, and diagnostic strings that describe the still-public Kapi workflow contract.
+- **Storage/config namespace:** `.ilchul`, `~/.ilchul`, `ILCHUL_*`, legacy `.kapi` references, and compatibility `KAPI_*` environment inputs.
 - **Documentation/history:** prose explaining migration context or historical behavior.
 
 ## Not changed in this slice

package.json

@@ -5,8 +5,7 @@
   "description": "Pi-native thin workflow harness inspired by Chedex, Ouroboros, OMX, and pi-mono.",
   "type": "module",
   "bin": {
-    "ilchul": "./bin/runctl.mjs",
-    "kapi-review": "./src/cli/kapi-review-cli.ts"
+    "ilchul": "./bin/runctl.mjs"
   },
   "keywords": [
     "pi-package",