[aepfli]

Draft, stacked on #1925 — the shape works, but the trade is a judgement call worth arguing before it merges.

Six commits, all aimed at the public API surface. A step class asks for what it needs:

public MySteps(TckState state, ProviderTckHarness harness, BackendControl backend) { … }

1. Our own ObjectFactory

PicoFactory offers no way to register an instance, and its isInstantiable refuses anything abstract, so an interface-typed parameter can never be satisfied. It is final, and delegating to it does not help either, since nothing can be added to its container. ObjectFactory is @API(STABLE); we register through META-INF/services, and the suite already selected the factory explicitly.

Scoping. Container per scenario, as the SPI specifies — TckState has no reset method, so the fresh container is the only thing keeping scenario N's thrown and events out of N+1. It holds four step instances and that state, no I/O. The harness, the backend control and the Compose stack are suite-scoped and registered by reference; stop() disposes the container and never touches them. That is why two flagd suites share one JVM with a Compose stack each.

What it costs. Three stock behaviours had to be reproduced, each found by a failing test rather than by reading the source:

• addClass registers constructor dependency types recursively — TckState is a parameter, not glue (126 UnsatisfiableDependencies).
• A run may have no suite lifecycle at all — ExtensionPointTest selects only the extension glue.
• Cucumber's component rule: public, concrete, not an inner class.

All three failed loudly, which is the good case; the risk worth weighing is the quiet variant, a dependency resolving to the wrong instance. Separately, an adopter who sets cucumber.object-factory themselves silently loses the injection.

It does not buy package-private step classes: MethodScanner applies its own public check during discovery, before the factory is consulted. GlueVisibilityTest from #1925 stays necessary.

2. The gate folds into Capability

CapabilityGate is gone; its four rules are Capability.requireDeclared(uri, tags, declared) — one public entry point, beside requireDeclarable(). The tag-only overload is package-private, as only tests in this package use it.

The reason to fold rather than move it to internal.steps: the rules read fromTag(), reserved(), tag(), inexpressible() and inexpressibleBecause(). A gate outside this package needs all five public — five leaked accessors instead of one entry point. (Relocating the two test classes would be mechanical; that is not what decides it.)

ProviderTck.gateScenario() goes with it, since ProviderSteps now receives the harness.

3. The lifecycle moved instead of going public

ProviderTck is three public constants and a private constructor — 192 lines to 48. startIfNeeded(), stop(), isRunning(), harness(), backendControl() and harness discovery are a package-private TckLifecycle in internal.steps, the package both callers already live in: ProviderSteps' @BeforeAll/@AfterAll, and the object factory, which moved there for that reason and stays public only because ServiceLoader requires it. No new public members.

Not driven from the ObjectFactory, though that looks like its natural home: start()/stop() are per scenario, so it could own construction but never suite teardown, and it cannot tell "suite not started yet" from "no suite wanted" — a launcher selecting only the extension glue would start Docker and then fail discovery. Hence the isRunning() guard rather than an eager lookup.

4. Capability narrowed to what adopters call

tag(), reserved(), inexpressible() and fromTag() are package-private; their only callers are KnownDeviation and the tests, both in this package. Across the four adoptions, the one method anything outside calls is declarableExcept().

Eight public members down to four: declarable() and declarableExcept() for harnesses, and requireDeclarable()/requireDeclared(), public only because internal.steps is a different package.

Free only pre-release — tck is not on Maven Central yet. Promoting a member later is source-compatible; demoting is not. This commit has to be reverted if the gate moves out of Capability.

5. A test was holding harnessClassOf open

TckSuiteListener.harnessClassOf() was public for one line in ExtensionPointTest, which borrowed it to find the suite node in a discovered plan. The listener calls it only from its own two hooks, so it is private now and the test names TckSuiteFixture itself.

Moving the test would have cost more than it saved -- it also reads three package-private root-package constants, so relocating it to internal trades one public method for three public constants. Subclassing could not have helped either: a static cannot be widened by inheritance.

Sweeping every public member in main for test-only callers turned up five candidates; four were false positives, since composeFile, declarableExcept, tracked and untracked are called by the adoptions.

6. ControlApi becomes BackendType

The old name described the thing by the API that drives it. What it actually says is whether the run drove a real backend over the control API or a provider with no backend inside this process -- a backend type. So the enum is BackendType and controlApi() is backendType(), and it stays public, because BackendControl can be implemented elsewhere and such an implementation has to declare which kind it is.

The enum being closed is what makes that safe: an implementor picks one of two values rather than inventing a third no report can validate. A public closed enum is therefore the whole answer -- there is no gap left for a sealed type to close, which matters because this module targets release 11.

It is not redundant with InProcessControl, which means in-process and supplies the provider. ControllableBackendControl in this module is in-process without being one, so deriving the value from the runtime type would report "http" for an in-process run -- a silently invalid conformance claim. wireValue() stays public with it, as the @JsonValue hook the report serialises through.

The report's JSON key is unaffected, coming from the field name on ConformanceReport.Backend. feat/provider-tck-report carries its own copy of the enum and a call site in TckRuntime, and picks the rename up there. Two javadoc comments also still sent adopters to the package-private HttpBackendControl; they point at BackendControl#overHttp now.

What is public, after all six

Read off javap over the compiled classes, not off the source. Outside the glue the module exposes thirteen types, all in dev.openfeature.contrib.tools.tck:

role	types
extend one of these	ProviderTckTest, ContainerizedProviderTckTest (or implement ProviderTckHarness)
declare with these	Capability (4 members), KnownDeviation
the backend seam	BackendControl, InProcessControl, BackendType, BackendEndpoint
reachable from step classes	TckState, FlagUnderTest, ProviderEventRecord
glue composition	ProviderTck -- three constants

Two more are public only structurally, both under internal: TckSuiteListener, whose type ServiceLoader requires and whose currentSuite() is read from internal.steps, and TckValues.convert(), crossing the same boundary.

Package-private, so invisible to an adopter: TckLifecycle, HttpBackendControl, InProcessBackendControl, CanonicalFlags, ReportNames.

Verification

• mvn -pl tools/tck test javadoc:javadoc — 250 tests, 0 failures on each commit, including ExtensionPointTest's no-suite launch.
• flagd, testbed v3.10.3, with tools/tck built in the reactor: both suites 65 scenarios, 59 passed, 2 skipped, 4 failed — the four this adoption already documents, the numeric-coercion gap and the two flags the testbed does not serve, identical across both resolvers.

An earlier run of mine used -pl providers/flagd, which resolves tools/tck from the local repository instead of the reactor: it exercised a stale jar and proved nothing. The numbers above are therefore a first measurement, not a confirmation, and there is no base-branch number taken the same way yet. That is the last thing I want before this leaves draft.

Still open

internal.steps is what forces requireDeclarable() and requireDeclared() public, and the same boundary forced five members public in #1923. A module-info.java, or collapsing the package into the one it serves, is the real fix — worth deciding before this merges rather than after.

extensions/README.md documented ProviderTck.harness() and backendControl(), which commit 1 makes package-private; it now documents the constructor injection that replaced them.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2450b577-a924-493b-8694-4887862d7de8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}