refactor(api-core): hide service runtime assembly

[poroh]

Reduce the public surface and clarify the boundary of carbide-api-core by keeping service runtime assembly private while exposing a narrow bootstrap interface to the carbide-api composition crate.

This is the fourth change in the series:

1. Move logging initialization and the top-level run entry point — refactor(api): move logging initialization into api crate #3851.
2. Move metrics initialization, the metrics endpoint, and process task ownership — refactor(api): move metrics initialization into api crate #3860.
3. Move database, Vault, credentials, certificates, KMS, and secret-import setup — refactor(api): move resource initialization into api crate #3864.
4. Consolidate the remaining service runtime assembly behind the hidden bootstrap interface — this PR.

This PR replaces the thin run boundary adapter with RuntimeInputs and start_runtime in the existing hidden bootstrap module. Dynamic settings and Redfish client setup remain internal to api-core, alongside API construction, controller startup, listener startup, and readiness signaling.

The existing startup behavior and configuration handling are preserved. Dependencies no longer used by api-core are removed, while test-only dependencies move to dev-dependencies.

Related issues

#3851
#3860
#3864

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

This PR is stacked on #3864 and should merge after it.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Summary by CodeRabbit

• Refactor
  • Reworked runtime startup into a clearer, two-phase initialization flow.
  • Runtime setup now creates and manages Redfish connection pools internally.
  • Removed obsolete runtime entry points and simplified cross-component initialization.
  • Updated configuration handling for deprecated proxy settings during startup.
• Chores
  • Cleaned up unused dependencies and adjusted development configuration.

Walkthrough

The runtime startup path now uses a two-phase prelude and injected runtime inputs. api-core constructs Redfish pools internally, while api wires the new bootstrap contract and updates dependencies and comments.

Changes

Runtime startup refactor

Layer / File(s)	Summary
Bootstrap boundary and prepared inputs crates/api-core/src/bootstrap.rs, crates/api-core/src/lib.rs, crates/api-core/src/run.rs	Introduces RuntimePrelude, RuntimeInputs, and start_runtime, removing the previous core runtime exports and module wiring.
Internal Redfish pool construction crates/api-core/src/setup.rs	Adds Redfish pool creation, migrates deprecated proxy settings, and constructs shared Redfish and NV Redfish pools during runtime startup.
API wiring and dependency alignment crates/api/src/run.rs, crates/api/src/main.rs, crates/api-core/Cargo.toml	Updates the API caller to use the two-phase startup flow, adjusts related comments, and aligns runtime and development dependencies.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ApiRun as crates/api::run
  participant Bootstrap as api-core::bootstrap
  participant Setup as api-core::setup
  participant Pools as Redfish pools
  ApiRun->>Bootstrap: start_runtime_prelude(config, logging, join_set, cancel_token)
  Bootstrap-->>ApiRun: RuntimePrelude
  ApiRun->>Bootstrap: start_runtime(RuntimeInputs)
  Bootstrap->>Setup: start_runtime(prepared inputs, dynamic_settings)
  Setup->>Pools: Create shared Redfish and NV Redfish pools
  Pools-->>Setup: Pool handles
  Setup-->>Bootstrap: Runtime result
  Bootstrap-->>ApiRun: Runtime result

Loading

Possibly related PRs

• NVIDIA/infra-controller#3851: Introduces the preceding CoreRunInputs/run_core runtime boundary.
• NVIDIA/infra-controller#3860: Moves telemetry and task orchestration ownership into crates/api.
• NVIDIA/infra-controller#3864: Refactors runtime startup to consume injected managers, pools, and secrets.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main refactor to hide api-core runtime assembly.
Description check	✅ Passed	The description matches the refactor and accurately describes the runtime boundary changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

crates/api-core/src/setup.rs (1)

135-187: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Deprecated-config migration logic is correct; one minor logging gap.

Verified the match is exhaustive and each branch leaves bmc_proxy in a consistent state. One nit: the (Some(_), _, Some(_)) arm only warns about override_target_ip when override_target_port is simultaneously set and ignored too — the operator isn't told about the second stale field. Not blocking given the low practical impact.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/api-core/src/setup.rs` around lines 135 - 187, Update the `(Some(_),
_, Some(_))` branch in `create_redfish_pool` so its warning also identifies the
deprecated `site_explorer.override_target_port` when that field is present and
ignored, while preserving the existing behavior for absent ports and configured
`bmc_proxy`.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/api-core/src/setup.rs`:
- Around line 135-187: Update the `(Some(_), _, Some(_))` branch in
`create_redfish_pool` so its warning also identifies the deprecated
`site_explorer.override_target_port` when that field is present and ignored,
while preserving the existing behavior for absent ports and configured
`bmc_proxy`.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8508c479-5b3f-4cb2-b972-c4949e4ae368

📥 Commits

Reviewing files that changed from the base of the PR and between 90a60ca and 5526c0f.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• crates/api-core/Cargo.toml
• crates/api-core/src/bootstrap.rs
• crates/api-core/src/lib.rs
• crates/api-core/src/run.rs
• crates/api-core/src/setup.rs
• crates/api/src/main.rs
• crates/api/src/run.rs

💤 Files with no reviewable changes (2)

• crates/api-core/src/lib.rs
• crates/api-core/src/run.rs